17 files changed, 1135 insertions, 542 deletions
diff --git a/deploy/flake.lock b/deploy/flake.lock
index 49e29c8..cac84a9 100644
--- a/deploy/flake.lock
+++ b/deploy/flake.lock
@@ -112,6 +112,22 @@
        "type": "path"
      }
    },
+    "borg-backup": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "buildslist": {
      "flake": false,
      "locked": {
@@ -146,7 +162,7 @@
    },
    "chatons": {
      "inputs": {
-        "environment": "environment"
+        "environment": "environment_2"
      },
      "locked": {
        "lastModified": 1,
@@ -161,7 +177,7 @@
    },
    "chatons_2": {
      "inputs": {
-        "environment": "environment_17"
+        "environment": "environment_19"
      },
      "locked": {
        "lastModified": 1,
@@ -674,11 +690,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -698,11 +714,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -710,11 +726,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -734,11 +750,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -758,11 +774,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -830,11 +846,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -874,6 +890,42 @@
        "type": "path"
      }
    },
+    "environment_33": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "environment_34": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "environment_35": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
    "environment_4": {
      "locked": {
        "lastModified": 1,
@@ -926,11 +978,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -938,11 +990,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -2703,8 +2755,8 @@
    },
    "mail-relay": {
      "inputs": {
-        "environment": "environment_3",
+        "environment": "environment_4",
-        "secrets": "secrets"
+        "secrets": "secrets_2"
      },
      "locked": {
        "lastModified": 1,
@@ -2719,8 +2771,8 @@
    },
    "mail-relay_2": {
      "inputs": {
-        "environment": "environment_19",
+        "environment": "environment_21",
-        "secrets": "secrets_14"
+        "secrets": "secrets_16"
      },
      "locked": {
        "lastModified": 1,
@@ -2760,6 +2812,7 @@
        "s-opendmarc": "s-opendmarc",
        "s-paste": "s-paste",
        "s-peertube": "s-peertube",
+        "s-private-borg-backup": "s-private-borg-backup",
        "s-private-buildbot": "s-private-buildbot",
        "s-private-chatons": "s-private-chatons",
        "s-private-environment": "s-private-environment",
@@ -2783,7 +2836,7 @@
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-bacTCDQeddb777/pYiLIhcSvxbc1WDQSXKqfTCJPzwo=",
+        "narHash": "sha256-iTtXjTzGUwsQahHeiQfECPmHZ/orceFH54SimHgpBaA=",
        "path": "../flakes",
        "type": "path"
      },
@@ -2868,11 +2921,11 @@
    },
    "milters": {
      "inputs": {
-        "environment": "environment_4",
+        "environment": "environment_5",
        "files-watcher": "files-watcher",
        "openarc": "openarc",
        "opendmarc": "opendmarc",
-        "secrets": "secrets_2"
+        "secrets": "secrets_3"
      },
      "locked": {
        "lastModified": 1,
@@ -2887,10 +2940,10 @@
    },
    "monitoring": {
      "inputs": {
-        "environment": "environment_5",
+        "environment": "environment_6",
        "naemon": "naemon",
        "nixpkgs-lib": "nixpkgs-lib",
-        "secrets": "secrets_3"
+        "secrets": "secrets_4"
      },
      "locked": {
        "lastModified": 1,
@@ -2905,10 +2958,10 @@
    },
    "monitoring_2": {
      "inputs": {
-        "environment": "environment_9",
+        "environment": "environment_10",
        "naemon": "naemon_2",
        "nixpkgs-lib": "nixpkgs-lib_4",
-        "secrets": "secrets_7"
+        "secrets": "secrets_8"
      },
      "locked": {
        "lastModified": 1,
@@ -2923,10 +2976,10 @@
    },
    "monitoring_3": {
      "inputs": {
-        "environment": "environment_20",
+        "environment": "environment_22",
        "naemon": "naemon_4",
        "nixpkgs-lib": "nixpkgs-lib_14",
-        "secrets": "secrets_15"
+        "secrets": "secrets_17"
      },
      "locked": {
        "lastModified": 1,
@@ -2941,10 +2994,10 @@
    },
    "monitoring_4": {
      "inputs": {
-        "environment": "environment_23",
+        "environment": "environment_25",
        "naemon": "naemon_5",
        "nixpkgs-lib": "nixpkgs-lib_17",
-        "secrets": "secrets_17"
+        "secrets": "secrets_19"
      },
      "locked": {
        "lastModified": 1,
@@ -3814,8 +3867,9 @@
    },
    "n-backup-2": {
      "inputs": {
+        "borg-backup": "borg-backup",
        "chatons": "chatons",
-        "environment": "environment_2",
+        "environment": "environment_3",
        "loginctl-linger": "loginctl-linger",
        "mail-relay": "mail-relay",
        "milters": "milters",
@@ -3827,12 +3881,12 @@
        "opendmarc": "opendmarc_2",
        "openldap": "openldap",
        "rsync_backup": "rsync_backup",
-        "secrets": "secrets_6",
+        "secrets": "secrets_7",
        "system": "system"
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-EPkvkGTy7RlhCXcngA/zGfXuiai7kE8YSL2siYe8HOI=",
+        "narHash": "sha256-gnCoyp6EcUzjBhmNrPel4ZzhK2nK6VLBziYJkKiXcuU=",
        "path": "../systems/backup-2",
        "type": "path"
      },
@@ -3843,14 +3897,14 @@
    },
    "n-dilion": {
      "inputs": {
-        "environment": "environment_8",
+        "environment": "environment_9",
        "files-watcher": "files-watcher_4",
        "loginctl-linger": "loginctl-linger_2",
        "monitoring": "monitoring_2",
        "my-lib": "my-lib_2",
        "myuids": "myuids_7",
        "nixpkgs": "nixpkgs_17",
-        "secrets": "secrets_8",
+        "secrets": "secrets_9",
        "system": "system_2"
      },
      "locked": {
@@ -3869,6 +3923,7 @@
        "dns-nix": "dns-nix",
        "my-lib": "my-lib_3",
        "nixpkgs": "nixpkgs_24",
+        "private-borg-backup": "private-borg-backup",
        "private-buildbot": "private-buildbot",
        "private-chatons": "private-chatons",
        "private-environment": "private-environment",
@@ -3903,7 +3958,7 @@
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-GP5n6/p0kgd0lf6KhPZqZxybcUPA38kl054Uo6CWYkE=",
+        "narHash": "sha256-deESGvYrIO1Luc3tD+a+QGq5w8ZlzZrIkJa6baDWhXE=",
        "path": "../systems/eldiron",
        "type": "path"
      },
@@ -3915,7 +3970,7 @@
    "n-monitoring-1": {
      "inputs": {
        "chatons": "chatons_2",
-        "environment": "environment_18",
+        "environment": "environment_20",
        "files-watcher": "files-watcher_9",
        "loginctl-linger": "loginctl-linger_3",
        "mail-relay": "mail-relay_2",
@@ -3924,7 +3979,7 @@
        "myuids": "myuids_23",
        "nixpkgs": "nixpkgs_55",
        "ports": "ports",
-        "secrets": "secrets_16",
+        "secrets": "secrets_18",
        "system": "system_3"
      },
      "locked": {
@@ -3940,7 +3995,7 @@
    },
    "n-quatresaisons": {
      "inputs": {
-        "environment": "environment_22",
+        "environment": "environment_24",
        "files-watcher": "files-watcher_10",
        "landing-page": "landing-page",
        "monitoring": "monitoring_4",
@@ -3949,7 +4004,7 @@
        "myuids": "myuids_26",
        "nixpkgs": "nixpkgs_63",
        "ports": "ports_2",
-        "secrets": "secrets_18",
+        "secrets": "secrets_20",
        "system": "system_4"
      },
      "locked": {
@@ -7000,7 +7055,7 @@
      "inputs": {
        "files-watcher": "files-watcher_2",
        "openarc": "openarc_4",
-        "secrets": "secrets_4"
+        "secrets": "secrets_5"
      },
      "locked": {
        "lastModified": 1,
@@ -7134,10 +7189,10 @@
    },
    "opendmarc_2": {
      "inputs": {
-        "environment": "environment_6",
+        "environment": "environment_7",
        "files-watcher": "files-watcher_3",
        "opendmarc": "opendmarc_3",
-        "secrets": "secrets_5"
+        "secrets": "secrets_6"
      },
      "locked": {
        "lastModified": 1,
@@ -7457,6 +7512,22 @@
        "type": "path"
      }
    },
+    "private-borg-backup": {
+      "inputs": {
+        "environment": "environment_12",
+        "secrets": "secrets_10"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "private-buildbot": {
      "inputs": {
        "buildslist": "buildslist",
@@ -7476,7 +7547,7 @@
    },
    "private-chatons": {
      "inputs": {
-        "environment": "environment_11"
+        "environment": "environment_13"
      },
      "locked": {
        "lastModified": 1,
@@ -7515,11 +7586,11 @@
    },
    "private-milters": {
      "inputs": {
-        "environment": "environment_12",
+        "environment": "environment_14",
        "files-watcher": "files-watcher_5",
        "openarc": "openarc_6",
        "opendmarc": "opendmarc_4",
-        "secrets": "secrets_9"
+        "secrets": "secrets_11"
      },
      "locked": {
        "lastModified": 1,
@@ -7534,10 +7605,10 @@
    },
    "private-monitoring": {
      "inputs": {
-        "environment": "environment_13",
+        "environment": "environment_15",
        "naemon": "naemon_3",
        "nixpkgs-lib": "nixpkgs-lib_8",
-        "secrets": "secrets_10"
+        "secrets": "secrets_12"
      },
      "locked": {
        "lastModified": 1,
@@ -7554,7 +7625,7 @@
      "inputs": {
        "files-watcher": "files-watcher_6",
        "openarc": "openarc_8",
-        "secrets": "secrets_11"
+        "secrets": "secrets_13"
      },
      "locked": {
        "lastModified": 1,
@@ -7569,10 +7640,10 @@
    },
    "private-opendmarc": {
      "inputs": {
-        "environment": "environment_14",
+        "environment": "environment_16",
        "files-watcher": "files-watcher_7",
        "opendmarc": "opendmarc_5",
-        "secrets": "secrets_12"
+        "secrets": "secrets_14"
      },
      "locked": {
        "lastModified": 1,
@@ -7632,8 +7703,8 @@
    },
    "private-ssh": {
      "inputs": {
-        "environment": "environment_15",
+        "environment": "environment_17",
-        "secrets": "secrets_13"
+        "secrets": "secrets_15"
      },
      "locked": {
        "lastModified": 1,
@@ -7649,7 +7720,7 @@
    "private-system": {
      "inputs": {
        "backports": "backports_3",
-        "environment": "environment_16",
+        "environment": "environment_18",
        "mypackages": "mypackages_3",
        "myuids": "myuids_15",
        "secrets-public": "secrets-public_3"
@@ -7668,7 +7739,7 @@
    "private-system_2": {
      "inputs": {
        "backports": "backports_6",
-        "environment": "environment_25",
+        "environment": "environment_27",
        "mypackages": "mypackages_9",
        "myuids": "myuids_28",
        "secrets-public": "secrets-public_6"
@@ -8005,7 +8076,7 @@
        "devshell": "devshell",
        "main-flake": "main-flake",
        "nixpkgs": "nixpkgs_105",
-        "secrets": "secrets_25"
+        "secrets": "secrets_28"
      }
    },
    "rsync_backup": {
@@ -8324,6 +8395,22 @@
        "type": "path"
      }
    },
+    "s-private-borg-backup": {
+      "inputs": {
+        "environment": "environment_28",
+        "secrets": "secrets_21"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "./private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "./private/borg_backup",
+        "type": "path"
+      }
+    },
    "s-private-buildbot": {
      "inputs": {
        "buildslist": "buildslist_2",
@@ -8343,7 +8430,7 @@
    },
    "s-private-chatons": {
      "inputs": {
-        "environment": "environment_26"
+        "environment": "environment_29"
      },
      "locked": {
        "lastModified": 1,
@@ -8370,8 +8457,8 @@
    },
    "s-private-mail-relay": {
      "inputs": {
-        "environment": "environment_27",
+        "environment": "environment_30",
-        "secrets": "secrets_19"
+        "secrets": "secrets_22"
      },
      "locked": {
        "lastModified": 1,
@@ -8386,11 +8473,11 @@
    },
    "s-private-milters": {
      "inputs": {
-        "environment": "environment_28",
+        "environment": "environment_31",
        "files-watcher": "files-watcher_13",
        "openarc": "openarc_12",
        "opendmarc": "opendmarc_6",
-        "secrets": "secrets_20"
+        "secrets": "secrets_23"
      },
      "locked": {
        "lastModified": 1,
@@ -8405,10 +8492,10 @@
    },
    "s-private-monitoring": {
      "inputs": {
-        "environment": "environment_29",
+        "environment": "environment_32",
        "naemon": "naemon_6",
        "nixpkgs-lib": "nixpkgs-lib_26",
-        "secrets": "secrets_21"
+        "secrets": "secrets_24"
      },
      "locked": {
        "lastModified": 1,
@@ -8425,7 +8512,7 @@
      "inputs": {
        "files-watcher": "files-watcher_14",
        "openarc": "openarc_14",
-        "secrets": "secrets_22"
+        "secrets": "secrets_25"
      },
      "locked": {
        "lastModified": 1,
@@ -8440,10 +8527,10 @@
    },
    "s-private-opendmarc": {
      "inputs": {
-        "environment": "environment_30",
+        "environment": "environment_33",
        "files-watcher": "files-watcher_15",
        "opendmarc": "opendmarc_7",
-        "secrets": "secrets_23"
+        "secrets": "secrets_26"
      },
      "locked": {
        "lastModified": 1,
@@ -8503,8 +8590,8 @@
    },
    "s-private-ssh": {
      "inputs": {
-        "environment": "environment_31",
+        "environment": "environment_34",
-        "secrets": "secrets_24"
+        "secrets": "secrets_27"
      },
      "locked": {
        "lastModified": 1,
@@ -8520,7 +8607,7 @@
    "s-private-system": {
      "inputs": {
        "backports": "backports_7",
-        "environment": "environment_32",
+        "environment": "environment_35",
        "mypackages": "mypackages_12",
        "myuids": "myuids_42",
        "secrets-public": "secrets-public_7"
@@ -8767,11 +8854,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8827,11 +8914,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -8884,6 +8971,42 @@
      }
    },
    "secrets_25": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_26": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_27": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_28": {
      "inputs": {
        "nixpkgs": "nixpkgs_106"
      },
@@ -8942,11 +9065,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8954,11 +9077,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -8966,11 +9089,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8978,11 +9101,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -9133,7 +9256,7 @@
    "system": {
      "inputs": {
        "backports": "backports",
-        "environment": "environment_7",
+        "environment": "environment_8",
        "mypackages": "mypackages",
        "myuids": "myuids_6",
        "secrets-public": "secrets-public"
@@ -9152,7 +9275,7 @@
    "system_2": {
      "inputs": {
        "backports": "backports_2",
-        "environment": "environment_10",
+        "environment": "environment_11",
        "mypackages": "mypackages_2",
        "myuids": "myuids_8",
        "secrets-public": "secrets-public_2"
@@ -9171,7 +9294,7 @@
    "system_3": {
      "inputs": {
        "backports": "backports_4",
-        "environment": "environment_21",
+        "environment": "environment_23",
        "mypackages": "mypackages_7",
        "myuids": "myuids_24",
        "secrets-public": "secrets-public_4"
@@ -9190,7 +9313,7 @@
    "system_4": {
      "inputs": {
        "backports": "backports_5",
-        "environment": "environment_24",
+        "environment": "environment_26",
        "mypackages": "mypackages_8",
        "myuids": "myuids_27",
        "secrets-public": "secrets-public_5"
diff --git a/flake.lock b/flake.lock
index 8bff4a1..b3d0db2 100644
--- a/flake.lock
+++ b/flake.lock
@@ -112,6 +112,22 @@
        "type": "path"
      }
    },
+    "borg-backup": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "buildslist": {
      "flake": false,
      "locked": {
@@ -146,7 +162,7 @@
    },
    "chatons": {
      "inputs": {
-        "environment": "environment"
+        "environment": "environment_2"
      },
      "locked": {
        "lastModified": 1,
@@ -161,7 +177,7 @@
    },
    "chatons_2": {
      "inputs": {
-        "environment": "environment_17"
+        "environment": "environment_19"
      },
      "locked": {
        "lastModified": 1,
@@ -674,11 +690,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -698,11 +714,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -710,11 +726,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -734,11 +750,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -758,11 +774,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -830,11 +846,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -874,6 +890,42 @@
        "type": "path"
      }
    },
+    "environment_33": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "environment_34": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "environment_35": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
    "environment_4": {
      "locked": {
        "lastModified": 1,
@@ -926,11 +978,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -938,11 +990,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -2643,6 +2695,7 @@
        "s-opendmarc": "s-opendmarc",
        "s-paste": "s-paste",
        "s-peertube": "s-peertube",
+        "s-private-borg-backup": "s-private-borg-backup",
        "s-private-buildbot": "s-private-buildbot",
        "s-private-chatons": "s-private-chatons",
        "s-private-environment": "s-private-environment",
@@ -2660,11 +2713,11 @@
        "s-secrets": "s-secrets",
        "s-surfer": "s-surfer",
        "s-taskwarrior-web": "s-taskwarrior-web",
-        "secrets": "secrets_25"
+        "secrets": "secrets_28"
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-bacTCDQeddb777/pYiLIhcSvxbc1WDQSXKqfTCJPzwo=",
+        "narHash": "sha256-iTtXjTzGUwsQahHeiQfECPmHZ/orceFH54SimHgpBaA=",
        "path": "./flakes",
        "type": "path"
      },
@@ -2778,8 +2831,8 @@
    },
    "mail-relay": {
      "inputs": {
-        "environment": "environment_3",
+        "environment": "environment_4",
-        "secrets": "secrets"
+        "secrets": "secrets_2"
      },
      "locked": {
        "lastModified": 1,
@@ -2794,8 +2847,8 @@
    },
    "mail-relay_2": {
      "inputs": {
-        "environment": "environment_19",
+        "environment": "environment_21",
-        "secrets": "secrets_14"
+        "secrets": "secrets_16"
      },
      "locked": {
        "lastModified": 1,
@@ -2884,11 +2937,11 @@
    },
    "milters": {
      "inputs": {
-        "environment": "environment_4",
+        "environment": "environment_5",
        "files-watcher": "files-watcher",
        "openarc": "openarc",
        "opendmarc": "opendmarc",
-        "secrets": "secrets_2"
+        "secrets": "secrets_3"
      },
      "locked": {
        "lastModified": 1,
@@ -2903,10 +2956,10 @@
    },
    "monitoring": {
      "inputs": {
-        "environment": "environment_5",
+        "environment": "environment_6",
        "naemon": "naemon",
        "nixpkgs-lib": "nixpkgs-lib_2",
-        "secrets": "secrets_3"
+        "secrets": "secrets_4"
      },
      "locked": {
        "lastModified": 1,
@@ -2921,10 +2974,10 @@
    },
    "monitoring_2": {
      "inputs": {
-        "environment": "environment_9",
+        "environment": "environment_10",
        "naemon": "naemon_2",
        "nixpkgs-lib": "nixpkgs-lib_5",
-        "secrets": "secrets_7"
+        "secrets": "secrets_8"
      },
      "locked": {
        "lastModified": 1,
@@ -2939,10 +2992,10 @@
    },
    "monitoring_3": {
      "inputs": {
-        "environment": "environment_20",
+        "environment": "environment_22",
        "naemon": "naemon_4",
        "nixpkgs-lib": "nixpkgs-lib_15",
-        "secrets": "secrets_15"
+        "secrets": "secrets_17"
      },
      "locked": {
        "lastModified": 1,
@@ -2957,10 +3010,10 @@
    },
    "monitoring_4": {
      "inputs": {
-        "environment": "environment_23",
+        "environment": "environment_25",
        "naemon": "naemon_5",
        "nixpkgs-lib": "nixpkgs-lib_18",
-        "secrets": "secrets_17"
+        "secrets": "secrets_19"
      },
      "locked": {
        "lastModified": 1,
@@ -3830,8 +3883,9 @@
    },
    "n-backup-2": {
      "inputs": {
+        "borg-backup": "borg-backup",
        "chatons": "chatons",
-        "environment": "environment_2",
+        "environment": "environment_3",
        "loginctl-linger": "loginctl-linger",
        "mail-relay": "mail-relay",
        "milters": "milters",
@@ -3843,12 +3897,12 @@
        "opendmarc": "opendmarc_2",
        "openldap": "openldap",
        "rsync_backup": "rsync_backup",
-        "secrets": "secrets_6",
+        "secrets": "secrets_7",
        "system": "system"
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-EPkvkGTy7RlhCXcngA/zGfXuiai7kE8YSL2siYe8HOI=",
+        "narHash": "sha256-gnCoyp6EcUzjBhmNrPel4ZzhK2nK6VLBziYJkKiXcuU=",
        "path": "../systems/backup-2",
        "type": "path"
      },
@@ -3859,14 +3913,14 @@
    },
    "n-dilion": {
      "inputs": {
-        "environment": "environment_8",
+        "environment": "environment_9",
        "files-watcher": "files-watcher_4",
        "loginctl-linger": "loginctl-linger_2",
        "monitoring": "monitoring_2",
        "my-lib": "my-lib_2",
        "myuids": "myuids_7",
        "nixpkgs": "nixpkgs_17",
-        "secrets": "secrets_8",
+        "secrets": "secrets_9",
        "system": "system_2"
      },
      "locked": {
@@ -3885,6 +3939,7 @@
        "dns-nix": "dns-nix",
        "my-lib": "my-lib_3",
        "nixpkgs": "nixpkgs_24",
+        "private-borg-backup": "private-borg-backup",
        "private-buildbot": "private-buildbot",
        "private-chatons": "private-chatons",
        "private-environment": "private-environment",
@@ -3919,7 +3974,7 @@
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-GP5n6/p0kgd0lf6KhPZqZxybcUPA38kl054Uo6CWYkE=",
+        "narHash": "sha256-deESGvYrIO1Luc3tD+a+QGq5w8ZlzZrIkJa6baDWhXE=",
        "path": "../systems/eldiron",
        "type": "path"
      },
@@ -3931,7 +3986,7 @@
    "n-monitoring-1": {
      "inputs": {
        "chatons": "chatons_2",
-        "environment": "environment_18",
+        "environment": "environment_20",
        "files-watcher": "files-watcher_9",
        "loginctl-linger": "loginctl-linger_3",
        "mail-relay": "mail-relay_2",
@@ -3940,7 +3995,7 @@
        "myuids": "myuids_23",
        "nixpkgs": "nixpkgs_55",
        "ports": "ports",
-        "secrets": "secrets_16",
+        "secrets": "secrets_18",
        "system": "system_3"
      },
      "locked": {
@@ -3956,7 +4011,7 @@
    },
    "n-quatresaisons": {
      "inputs": {
-        "environment": "environment_22",
+        "environment": "environment_24",
        "files-watcher": "files-watcher_10",
        "landing-page": "landing-page",
        "monitoring": "monitoring_4",
@@ -3965,7 +4020,7 @@
        "myuids": "myuids_26",
        "nixpkgs": "nixpkgs_63",
        "ports": "ports_2",
-        "secrets": "secrets_18",
+        "secrets": "secrets_20",
        "system": "system_4"
      },
      "locked": {
@@ -7016,7 +7071,7 @@
      "inputs": {
        "files-watcher": "files-watcher_2",
        "openarc": "openarc_4",
-        "secrets": "secrets_4"
+        "secrets": "secrets_5"
      },
      "locked": {
        "lastModified": 1,
@@ -7150,10 +7205,10 @@
    },
    "opendmarc_2": {
      "inputs": {
-        "environment": "environment_6",
+        "environment": "environment_7",
        "files-watcher": "files-watcher_3",
        "opendmarc": "opendmarc_3",
-        "secrets": "secrets_5"
+        "secrets": "secrets_6"
      },
      "locked": {
        "lastModified": 1,
@@ -7473,6 +7528,22 @@
        "type": "path"
      }
    },
+    "private-borg-backup": {
+      "inputs": {
+        "environment": "environment_12",
+        "secrets": "secrets_10"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "private-buildbot": {
      "inputs": {
        "buildslist": "buildslist",
@@ -7492,7 +7563,7 @@
    },
    "private-chatons": {
      "inputs": {
-        "environment": "environment_11"
+        "environment": "environment_13"
      },
      "locked": {
        "lastModified": 1,
@@ -7531,11 +7602,11 @@
    },
    "private-milters": {
      "inputs": {
-        "environment": "environment_12",
+        "environment": "environment_14",
        "files-watcher": "files-watcher_5",
        "openarc": "openarc_6",
        "opendmarc": "opendmarc_4",
-        "secrets": "secrets_9"
+        "secrets": "secrets_11"
      },
      "locked": {
        "lastModified": 1,
@@ -7550,10 +7621,10 @@
    },
    "private-monitoring": {
      "inputs": {
-        "environment": "environment_13",
+        "environment": "environment_15",
        "naemon": "naemon_3",
        "nixpkgs-lib": "nixpkgs-lib_9",
-        "secrets": "secrets_10"
+        "secrets": "secrets_12"
      },
      "locked": {
        "lastModified": 1,
@@ -7570,7 +7641,7 @@
      "inputs": {
        "files-watcher": "files-watcher_6",
        "openarc": "openarc_8",
-        "secrets": "secrets_11"
+        "secrets": "secrets_13"
      },
      "locked": {
        "lastModified": 1,
@@ -7585,10 +7656,10 @@
    },
    "private-opendmarc": {
      "inputs": {
-        "environment": "environment_14",
+        "environment": "environment_16",
        "files-watcher": "files-watcher_7",
        "opendmarc": "opendmarc_5",
-        "secrets": "secrets_12"
+        "secrets": "secrets_14"
      },
      "locked": {
        "lastModified": 1,
@@ -7648,8 +7719,8 @@
    },
    "private-ssh": {
      "inputs": {
-        "environment": "environment_15",
+        "environment": "environment_17",
-        "secrets": "secrets_13"
+        "secrets": "secrets_15"
      },
      "locked": {
        "lastModified": 1,
@@ -7665,7 +7736,7 @@
    "private-system": {
      "inputs": {
        "backports": "backports_3",
-        "environment": "environment_16",
+        "environment": "environment_18",
        "mypackages": "mypackages_3",
        "myuids": "myuids_15",
        "secrets-public": "secrets-public_3"
@@ -7684,7 +7755,7 @@
    "private-system_2": {
      "inputs": {
        "backports": "backports_6",
-        "environment": "environment_25",
+        "environment": "environment_27",
        "mypackages": "mypackages_9",
        "myuids": "myuids_28",
        "secrets-public": "secrets-public_6"
@@ -8340,6 +8411,22 @@
        "type": "path"
      }
    },
+    "s-private-borg-backup": {
+      "inputs": {
+        "environment": "environment_28",
+        "secrets": "secrets_21"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "./private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "./private/borg_backup",
+        "type": "path"
+      }
+    },
    "s-private-buildbot": {
      "inputs": {
        "buildslist": "buildslist_2",
@@ -8359,7 +8446,7 @@
    },
    "s-private-chatons": {
      "inputs": {
-        "environment": "environment_26"
+        "environment": "environment_29"
      },
      "locked": {
        "lastModified": 1,
@@ -8386,8 +8473,8 @@
    },
    "s-private-mail-relay": {
      "inputs": {
-        "environment": "environment_27",
+        "environment": "environment_30",
-        "secrets": "secrets_19"
+        "secrets": "secrets_22"
      },
      "locked": {
        "lastModified": 1,
@@ -8402,11 +8489,11 @@
    },
    "s-private-milters": {
      "inputs": {
-        "environment": "environment_28",
+        "environment": "environment_31",
        "files-watcher": "files-watcher_13",
        "openarc": "openarc_12",
        "opendmarc": "opendmarc_6",
-        "secrets": "secrets_20"
+        "secrets": "secrets_23"
      },
      "locked": {
        "lastModified": 1,
@@ -8421,10 +8508,10 @@
    },
    "s-private-monitoring": {
      "inputs": {
-        "environment": "environment_29",
+        "environment": "environment_32",
        "naemon": "naemon_6",
        "nixpkgs-lib": "nixpkgs-lib_27",
-        "secrets": "secrets_21"
+        "secrets": "secrets_24"
      },
      "locked": {
        "lastModified": 1,
@@ -8441,7 +8528,7 @@
      "inputs": {
        "files-watcher": "files-watcher_14",
        "openarc": "openarc_14",
-        "secrets": "secrets_22"
+        "secrets": "secrets_25"
      },
      "locked": {
        "lastModified": 1,
@@ -8456,10 +8543,10 @@
    },
    "s-private-opendmarc": {
      "inputs": {
-        "environment": "environment_30",
+        "environment": "environment_33",
        "files-watcher": "files-watcher_15",
        "opendmarc": "opendmarc_7",
-        "secrets": "secrets_23"
+        "secrets": "secrets_26"
      },
      "locked": {
        "lastModified": 1,
@@ -8519,8 +8606,8 @@
    },
    "s-private-ssh": {
      "inputs": {
-        "environment": "environment_31",
+        "environment": "environment_34",
-        "secrets": "secrets_24"
+        "secrets": "secrets_27"
      },
      "locked": {
        "lastModified": 1,
@@ -8536,7 +8623,7 @@
    "s-private-system": {
      "inputs": {
        "backports": "backports_7",
-        "environment": "environment_32",
+        "environment": "environment_35",
        "mypackages": "mypackages_12",
        "myuids": "myuids_42",
        "secrets-public": "secrets-public_7"
@@ -8783,11 +8870,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8843,11 +8930,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -8902,6 +8989,42 @@
    "secrets_25": {
      "locked": {
        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_26": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_27": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_28": {
+      "locked": {
+        "lastModified": 1,
        "narHash": "sha256-yvhc2jxW1AQVmtrKPoYPr5DgpXKt/ua+ATuxvE3iY6c=",
        "path": "./private/environment-dummy",
        "type": "path"
@@ -8951,11 +9074,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8963,11 +9086,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -8975,11 +9098,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8987,11 +9110,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -9142,7 +9265,7 @@
    "system": {
      "inputs": {
        "backports": "backports",
-        "environment": "environment_7",
+        "environment": "environment_8",
        "mypackages": "mypackages",
        "myuids": "myuids_6",
        "secrets-public": "secrets-public"
@@ -9161,7 +9284,7 @@
    "system_2": {
      "inputs": {
        "backports": "backports_2",
-        "environment": "environment_10",
+        "environment": "environment_11",
        "mypackages": "mypackages_2",
        "myuids": "myuids_8",
        "secrets-public": "secrets-public_2"
@@ -9180,7 +9303,7 @@
    "system_3": {
      "inputs": {
        "backports": "backports_4",
-        "environment": "environment_21",
+        "environment": "environment_23",
        "mypackages": "mypackages_7",
        "myuids": "myuids_24",
        "secrets-public": "secrets-public_4"
@@ -9199,7 +9322,7 @@
    "system_4": {
      "inputs": {
        "backports": "backports_5",
-        "environment": "environment_24",
+        "environment": "environment_26",
        "mypackages": "mypackages_8",
        "myuids": "myuids_27",
        "secrets-public": "secrets-public_5"
diff --git a/flakes/flake.lock b/flakes/flake.lock
index cbdd1a3..86fa845 100644
--- a/flakes/flake.lock
+++ b/flakes/flake.lock
@@ -112,6 +112,22 @@
        "type": "path"
      }
    },
+    "borg-backup": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "buildslist": {
      "flake": false,
      "locked": {
@@ -146,7 +162,7 @@
    },
    "chatons": {
      "inputs": {
-        "environment": "environment"
+        "environment": "environment_2"
      },
      "locked": {
        "lastModified": 1,
@@ -161,7 +177,7 @@
    },
    "chatons_2": {
      "inputs": {
-        "environment": "environment_17"
+        "environment": "environment_19"
      },
      "locked": {
        "lastModified": 1,
@@ -654,11 +670,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -678,11 +694,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -690,11 +706,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -714,11 +730,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -738,11 +754,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -810,11 +826,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -854,6 +870,42 @@
        "type": "path"
      }
    },
+    "environment_33": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "environment_34": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "environment_35": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
    "environment_4": {
      "locked": {
        "lastModified": 1,
@@ -906,11 +958,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -918,11 +970,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -2683,8 +2735,8 @@
    },
    "mail-relay": {
      "inputs": {
-        "environment": "environment_3",
+        "environment": "environment_4",
-        "secrets": "secrets"
+        "secrets": "secrets_2"
      },
      "locked": {
        "lastModified": 1,
@@ -2699,8 +2751,8 @@
    },
    "mail-relay_2": {
      "inputs": {
-        "environment": "environment_19",
+        "environment": "environment_21",
-        "secrets": "secrets_14"
+        "secrets": "secrets_16"
      },
      "locked": {
        "lastModified": 1,
@@ -2789,11 +2841,11 @@
    },
    "milters": {
      "inputs": {
-        "environment": "environment_4",
+        "environment": "environment_5",
        "files-watcher": "files-watcher",
        "openarc": "openarc",
        "opendmarc": "opendmarc",
-        "secrets": "secrets_2"
+        "secrets": "secrets_3"
      },
      "locked": {
        "lastModified": 1,
@@ -2808,10 +2860,10 @@
    },
    "monitoring": {
      "inputs": {
-        "environment": "environment_5",
+        "environment": "environment_6",
        "naemon": "naemon",
        "nixpkgs-lib": "nixpkgs-lib",
-        "secrets": "secrets_3"
+        "secrets": "secrets_4"
      },
      "locked": {
        "lastModified": 1,
@@ -2826,10 +2878,10 @@
    },
    "monitoring_2": {
      "inputs": {
-        "environment": "environment_9",
+        "environment": "environment_10",
        "naemon": "naemon_2",
        "nixpkgs-lib": "nixpkgs-lib_4",
-        "secrets": "secrets_7"
+        "secrets": "secrets_8"
      },
      "locked": {
        "lastModified": 1,
@@ -2844,10 +2896,10 @@
    },
    "monitoring_3": {
      "inputs": {
-        "environment": "environment_20",
+        "environment": "environment_22",
        "naemon": "naemon_4",
        "nixpkgs-lib": "nixpkgs-lib_14",
-        "secrets": "secrets_15"
+        "secrets": "secrets_17"
      },
      "locked": {
        "lastModified": 1,
@@ -2862,10 +2914,10 @@
    },
    "monitoring_4": {
      "inputs": {
-        "environment": "environment_23",
+        "environment": "environment_25",
        "naemon": "naemon_5",
        "nixpkgs-lib": "nixpkgs-lib_17",
-        "secrets": "secrets_17"
+        "secrets": "secrets_19"
      },
      "locked": {
        "lastModified": 1,
@@ -3735,8 +3787,9 @@
    },
    "n-backup-2": {
      "inputs": {
+        "borg-backup": "borg-backup",
        "chatons": "chatons",
-        "environment": "environment_2",
+        "environment": "environment_3",
        "loginctl-linger": "loginctl-linger",
        "mail-relay": "mail-relay",
        "milters": "milters",
@@ -3748,12 +3801,12 @@
        "opendmarc": "opendmarc_2",
        "openldap": "openldap",
        "rsync_backup": "rsync_backup",
-        "secrets": "secrets_6",
+        "secrets": "secrets_7",
        "system": "system"
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-EPkvkGTy7RlhCXcngA/zGfXuiai7kE8YSL2siYe8HOI=",
+        "narHash": "sha256-gnCoyp6EcUzjBhmNrPel4ZzhK2nK6VLBziYJkKiXcuU=",
        "path": "../systems/backup-2",
        "type": "path"
      },
@@ -3764,14 +3817,14 @@
    },
    "n-dilion": {
      "inputs": {
-        "environment": "environment_8",
+        "environment": "environment_9",
        "files-watcher": "files-watcher_4",
        "loginctl-linger": "loginctl-linger_2",
        "monitoring": "monitoring_2",
        "my-lib": "my-lib_2",
        "myuids": "myuids_7",
        "nixpkgs": "nixpkgs_16",
-        "secrets": "secrets_8",
+        "secrets": "secrets_9",
        "system": "system_2"
      },
      "locked": {
@@ -3790,6 +3843,7 @@
        "dns-nix": "dns-nix",
        "my-lib": "my-lib_3",
        "nixpkgs": "nixpkgs_23",
+        "private-borg-backup": "private-borg-backup",
        "private-buildbot": "private-buildbot",
        "private-chatons": "private-chatons",
        "private-environment": "private-environment",
@@ -3824,7 +3878,7 @@
      },
      "locked": {
        "lastModified": 1,
-        "narHash": "sha256-GP5n6/p0kgd0lf6KhPZqZxybcUPA38kl054Uo6CWYkE=",
+        "narHash": "sha256-deESGvYrIO1Luc3tD+a+QGq5w8ZlzZrIkJa6baDWhXE=",
        "path": "../systems/eldiron",
        "type": "path"
      },
@@ -3836,7 +3890,7 @@
    "n-monitoring-1": {
      "inputs": {
        "chatons": "chatons_2",
-        "environment": "environment_18",
+        "environment": "environment_20",
        "files-watcher": "files-watcher_9",
        "loginctl-linger": "loginctl-linger_3",
        "mail-relay": "mail-relay_2",
@@ -3845,7 +3899,7 @@
        "myuids": "myuids_23",
        "nixpkgs": "nixpkgs_54",
        "ports": "ports",
-        "secrets": "secrets_16",
+        "secrets": "secrets_18",
        "system": "system_3"
      },
      "locked": {
@@ -3861,7 +3915,7 @@
    },
    "n-quatresaisons": {
      "inputs": {
-        "environment": "environment_22",
+        "environment": "environment_24",
        "files-watcher": "files-watcher_10",
        "landing-page": "landing-page",
        "monitoring": "monitoring_4",
@@ -3870,7 +3924,7 @@
        "myuids": "myuids_26",
        "nixpkgs": "nixpkgs_62",
        "ports": "ports_2",
-        "secrets": "secrets_18",
+        "secrets": "secrets_20",
        "system": "system_4"
      },
      "locked": {
@@ -6843,7 +6897,7 @@
      "inputs": {
        "files-watcher": "files-watcher_2",
        "openarc": "openarc_4",
-        "secrets": "secrets_4"
+        "secrets": "secrets_5"
      },
      "locked": {
        "lastModified": 1,
@@ -6977,10 +7031,10 @@
    },
    "opendmarc_2": {
      "inputs": {
-        "environment": "environment_6",
+        "environment": "environment_7",
        "files-watcher": "files-watcher_3",
        "opendmarc": "opendmarc_3",
-        "secrets": "secrets_5"
+        "secrets": "secrets_6"
      },
      "locked": {
        "lastModified": 1,
@@ -7300,6 +7354,22 @@
        "type": "path"
      }
    },
+    "private-borg-backup": {
+      "inputs": {
+        "environment": "environment_12",
+        "secrets": "secrets_10"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "private-buildbot": {
      "inputs": {
        "buildslist": "buildslist",
@@ -7319,7 +7389,7 @@
    },
    "private-chatons": {
      "inputs": {
-        "environment": "environment_11"
+        "environment": "environment_13"
      },
      "locked": {
        "lastModified": 1,
@@ -7358,11 +7428,11 @@
    },
    "private-milters": {
      "inputs": {
-        "environment": "environment_12",
+        "environment": "environment_14",
        "files-watcher": "files-watcher_5",
        "openarc": "openarc_6",
        "opendmarc": "opendmarc_4",
-        "secrets": "secrets_9"
+        "secrets": "secrets_11"
      },
      "locked": {
        "lastModified": 1,
@@ -7377,10 +7447,10 @@
    },
    "private-monitoring": {
      "inputs": {
-        "environment": "environment_13",
+        "environment": "environment_15",
        "naemon": "naemon_3",
        "nixpkgs-lib": "nixpkgs-lib_8",
-        "secrets": "secrets_10"
+        "secrets": "secrets_12"
      },
      "locked": {
        "lastModified": 1,
@@ -7397,7 +7467,7 @@
      "inputs": {
        "files-watcher": "files-watcher_6",
        "openarc": "openarc_8",
-        "secrets": "secrets_11"
+        "secrets": "secrets_13"
      },
      "locked": {
        "lastModified": 1,
@@ -7412,10 +7482,10 @@
    },
    "private-opendmarc": {
      "inputs": {
-        "environment": "environment_14",
+        "environment": "environment_16",
        "files-watcher": "files-watcher_7",
        "opendmarc": "opendmarc_5",
-        "secrets": "secrets_12"
+        "secrets": "secrets_14"
      },
      "locked": {
        "lastModified": 1,
@@ -7475,8 +7545,8 @@
    },
    "private-ssh": {
      "inputs": {
-        "environment": "environment_15",
+        "environment": "environment_17",
-        "secrets": "secrets_13"
+        "secrets": "secrets_15"
      },
      "locked": {
        "lastModified": 1,
@@ -7492,7 +7562,7 @@
    "private-system": {
      "inputs": {
        "backports": "backports_3",
-        "environment": "environment_16",
+        "environment": "environment_18",
        "mypackages": "mypackages_3",
        "myuids": "myuids_15",
        "secrets-public": "secrets-public_3"
@@ -7511,7 +7581,7 @@
    "private-system_2": {
      "inputs": {
        "backports": "backports_6",
-        "environment": "environment_25",
+        "environment": "environment_27",
        "mypackages": "mypackages_9",
        "myuids": "myuids_28",
        "secrets-public": "secrets-public_6"
@@ -7870,6 +7940,7 @@
        "s-opendmarc": "s-opendmarc",
        "s-paste": "s-paste",
        "s-peertube": "s-peertube",
+        "s-private-borg-backup": "s-private-borg-backup",
        "s-private-buildbot": "s-private-buildbot",
        "s-private-chatons": "s-private-chatons",
        "s-private-environment": "s-private-environment",
@@ -7887,7 +7958,7 @@
        "s-secrets": "s-secrets",
        "s-surfer": "s-surfer",
        "s-taskwarrior-web": "s-taskwarrior-web",
-        "secrets": "secrets_25"
+        "secrets": "secrets_28"
      }
    },
    "rsync_backup": {
@@ -8206,6 +8277,22 @@
        "type": "path"
      }
    },
+    "s-private-borg-backup": {
+      "inputs": {
+        "environment": "environment_28",
+        "secrets": "secrets_21"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "./private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "./private/borg_backup",
+        "type": "path"
+      }
+    },
    "s-private-buildbot": {
      "inputs": {
        "buildslist": "buildslist_2",
@@ -8225,7 +8312,7 @@
    },
    "s-private-chatons": {
      "inputs": {
-        "environment": "environment_26"
+        "environment": "environment_29"
      },
      "locked": {
        "lastModified": 1,
@@ -8252,8 +8339,8 @@
    },
    "s-private-mail-relay": {
      "inputs": {
-        "environment": "environment_27",
+        "environment": "environment_30",
-        "secrets": "secrets_19"
+        "secrets": "secrets_22"
      },
      "locked": {
        "lastModified": 1,
@@ -8268,11 +8355,11 @@
    },
    "s-private-milters": {
      "inputs": {
-        "environment": "environment_28",
+        "environment": "environment_31",
        "files-watcher": "files-watcher_13",
        "openarc": "openarc_12",
        "opendmarc": "opendmarc_6",
-        "secrets": "secrets_20"
+        "secrets": "secrets_23"
      },
      "locked": {
        "lastModified": 1,
@@ -8287,10 +8374,10 @@
    },
    "s-private-monitoring": {
      "inputs": {
-        "environment": "environment_29",
+        "environment": "environment_32",
        "naemon": "naemon_6",
        "nixpkgs-lib": "nixpkgs-lib_26",
-        "secrets": "secrets_21"
+        "secrets": "secrets_24"
      },
      "locked": {
        "lastModified": 1,
@@ -8307,7 +8394,7 @@
      "inputs": {
        "files-watcher": "files-watcher_14",
        "openarc": "openarc_14",
-        "secrets": "secrets_22"
+        "secrets": "secrets_25"
      },
      "locked": {
        "lastModified": 1,
@@ -8322,10 +8409,10 @@
    },
    "s-private-opendmarc": {
      "inputs": {
-        "environment": "environment_30",
+        "environment": "environment_33",
        "files-watcher": "files-watcher_15",
        "opendmarc": "opendmarc_7",
-        "secrets": "secrets_23"
+        "secrets": "secrets_26"
      },
      "locked": {
        "lastModified": 1,
@@ -8385,8 +8472,8 @@
    },
    "s-private-ssh": {
      "inputs": {
-        "environment": "environment_31",
+        "environment": "environment_34",
-        "secrets": "secrets_24"
+        "secrets": "secrets_27"
      },
      "locked": {
        "lastModified": 1,
@@ -8402,7 +8489,7 @@
    "s-private-system": {
      "inputs": {
        "backports": "backports_7",
-        "environment": "environment_32",
+        "environment": "environment_35",
        "mypackages": "mypackages_12",
        "myuids": "myuids_42",
        "secrets-public": "secrets-public_7"
@@ -8649,11 +8736,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8709,11 +8796,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -8768,6 +8855,42 @@
    "secrets_25": {
      "locked": {
        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_26": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_27": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_28": {
+      "locked": {
+        "lastModified": 1,
        "narHash": "sha256-yvhc2jxW1AQVmtrKPoYPr5DgpXKt/ua+ATuxvE3iY6c=",
        "path": "./private/environment-dummy",
        "type": "path"
@@ -8817,11 +8940,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8829,11 +8952,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -8841,11 +8964,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/secrets",
+        "path": "../../secrets",
        "type": "path"
      }
    },
@@ -8853,11 +8976,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      },
      "original": {
-        "path": "../../secrets",
+        "path": "../../flakes/secrets",
        "type": "path"
      }
    },
@@ -9008,7 +9131,7 @@
    "system": {
      "inputs": {
        "backports": "backports",
-        "environment": "environment_7",
+        "environment": "environment_8",
        "mypackages": "mypackages",
        "myuids": "myuids_6",
        "secrets-public": "secrets-public"
@@ -9027,7 +9150,7 @@
    "system_2": {
      "inputs": {
        "backports": "backports_2",
-        "environment": "environment_10",
+        "environment": "environment_11",
        "mypackages": "mypackages_2",
        "myuids": "myuids_8",
        "secrets-public": "secrets-public_2"
@@ -9046,7 +9169,7 @@
    "system_3": {
      "inputs": {
        "backports": "backports_4",
-        "environment": "environment_21",
+        "environment": "environment_23",
        "mypackages": "mypackages_7",
        "myuids": "myuids_24",
        "secrets-public": "secrets-public_4"
@@ -9065,7 +9188,7 @@
    "system_4": {
      "inputs": {
        "backports": "backports_5",
-        "environment": "environment_24",
+        "environment": "environment_26",
        "mypackages": "mypackages_8",
        "myuids": "myuids_27",
        "secrets-public": "secrets-public_5"
diff --git a/flakes/flake.nix b/flakes/flake.nix
index 95498de..2db031d 100644
--- a/flakes/flake.nix
+++ b/flakes/flake.nix
@@ -25,6 +25,7 @@
    s-surfer.url = "path:./surfer";
    s-taskwarrior-web.url = "path:./taskwarrior-web";
+    s-private-borg-backup.url = "path:./private/borg_backup";
    s-private-buildbot.url = "path:./private/buildbot";
    s-private-chatons.url = "path:./private/chatons";
    s-private-environment.url = "path:./private/environment";
diff --git a/flakes/private/borg_backup/flake.lock b/flakes/private/borg_backup/flake.lock
new file mode 100644
index 0000000..4d620ad
--- /dev/null
+++ b/flakes/private/borg_backup/flake.lock
@@ -0,0 +1,36 @@
+{
+  "nodes": {
+    "environment": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "root": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      }
+    },
+    "secrets": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flakes/private/borg_backup/flake.nix b/flakes/private/borg_backup/flake.nix
new file mode 100644
index 0000000..ad7d6eb
--- /dev/null
+++ b/flakes/private/borg_backup/flake.nix
@@ -0,0 +1,321 @@
+{
+  inputs.environment.url = "path:../environment";
+  inputs.secrets.url = "path:../../secrets";
+  outputs = { self, environment, secrets }: {
+    nixosModule = self.nixosModules.borgBackup;
+    nixosModules.borgBackup = { lib, pkgs, config, name, ... }:
+      let
+        cfg = config.myEnv.borg_backup;
+        varDir = "/var/lib/borgbackup";
+        borg_args = "--encryption repokey --make-parent-dirs init create prune compact check";
+        borg_backup_full_with_ignored = pkgs.writeScriptBin "borg_full_with_ignored" ''
+          #!${pkgs.stdenv.shell}
+          if [ -z "$1" -o "$1" = "-h" -o "$1" = "--help" ]; then
+            echo "borg_full_with_ignored /path/to/borgmatic.yaml"
+            echo "Does a full backup including directories with .duplicity-ignore"
+            exit 1
+          fi
+          ${pkgs.borgmatic}/bin/borgmatic -c "$1" --override 'storage.archive_name_format="{hostname}-with-ignored-{now:%Y-%m-%dT%H:%M:%S.%f}"' --override 'location.exclude_if_present=[]' ${borg_args}
+        '';
+        borg_backup = pkgs.writeScriptBin "borg_backup" ''
+          #!${pkgs.stdenv.shell}
+          declare -a profiles
+          profiles=()
+          ${builtins.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (k: v: map (remote: [
+            ''profiles+=("${remote}_${k}")''
+          ]) v.remotes) config.services.borgBackup.profiles))}
+          if [ -f "${varDir}/last_backup_profile" ]; then
+            last_backup=$(cat ${varDir}/last_backup_profile)
+            for i in "''${!profiles[@]}"; do
+              if [[ "''${profiles[$i]}" = "$last_backup" ]]; then
+                break
+              fi
+            done
+            ((i+=1))
+            profiles=("''${profiles[@]:$i}" "''${profiles[@]:0:$i}")
+          fi
+          # timeout in minutes
+          timeout="''${1:-180}"
+          timeout_timestamp=$(date +%s -d "$timeout minutes")
+          for profile in "''${profiles[@]}"; do
+            if [ $(date +%s -d "now") -ge "$timeout_timestamp" ]; then
+              break
+            fi
+            touch "${varDir}/$profile.log"
+            ${pkgs.borgmatic}/bin/borgmatic -c "${config.secrets.location}/borg_backup/$profile/borgmatic.yaml" ${borg_args} >> ${varDir}/$profile.log
+            [[ $? = 0 ]] || echo -e "Error when doing backup for $profile, see above or logs in ${varDir}/$profile.log\n---------------------------------------" >&2
+            echo "$profile" > ${varDir}/last_backup_profile
+          done
+        '';
+        check_mysql_backups = pkgs.writeScriptBin "borg_list_mysql_not_backuped" ''
+          #!${pkgs.stdenv.shell}
+          comm -13 <(cat ${config.secrets.fullPaths."borg_backup/backuped_mysql_list"} | sort) <(mysql --defaults-file=${config.secrets.fullPaths."mysql_replication/eldiron/client"} -N -s -S /run/mysqld_eldiron/mysqld.sock -e "show databases;" | sort)
+        '';
+        check_psql_backups = pkgs.writeScriptBin "borg_list_psql_not_backuped" ''
+          #!${pkgs.stdenv.shell}
+          comm -13 <(cat ${config.secrets.fullPaths."borg_backup/backuped_psql_list"} | sort) <(sudo -u postgres psql -h /backup2/eldiron/postgresql -Atq -c "SELECT datname FROM pg_catalog.pg_database" | sort)
+        '';
+        check_backups = pkgs.writeScriptBin "borg_list_not_backuped" ''
+          #!${pkgs.stdenv.shell}
+          do_check() {
+            local dir="$1" path ignored_path
+            find "$dir" -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
+              if ${pkgs.gnugrep}/bin/grep -qFx "$path" ${config.secrets.fullPaths."borg_backup/backuped_list"}; then
+                continue
+              elif ${pkgs.gnugrep}/bin/grep -q "^$path/" ${config.secrets.fullPaths."borg_backup/backuped_list"}; then
+                do_check "$path"
+              else
+                while IFS= read -r ignored_path; do
+                  if [[ "$path" =~ ^$ignored_path$ ]]; then
+                    continue 2
+                  fi
+                done < ${config.secrets.fullPaths."borg_backup/ignored_list"}
+                printf '%s\n' "$path"
+              fi
+            done
+          }
+          do_check /var/lib
+        '';
+        borgProfile = profile: remote: bucket: builtins.toJSON {
+          location = {
+            source_directories = map (p: "${profile.rootDir}/${p}") profile.includedPaths;
+            repositories = [
+              { path = cfg.remotes.${remote}.remote name bucket; label = "backupserver"; }
+            ];
+            one_file_system = false;
+            exclude_if_present = [".duplicity-ignore"];
+            source_directories_must_exist = profile.directoriesMustExist;
+            borgmatic_source_directory = "${varDir}/${profile.bucket}/.borgmatic";
+          };
+          hooks = {
+            mysql_databases = profile.mariaDBDatabases;
+            postgresql_databases = profile.postgresqlDatabases;
+            before_backup = lib.optional (profile.postgresqlDatabasesPauseReplicationHost != null) "sudo -u postgres psql -h ${profile.postgresqlDatabasesPauseReplicationHost} -c 'SELECT pg_wal_replay_pause();' >/dev/null";
+            after_backup = lib.optional (profile.postgresqlDatabasesPauseReplicationHost != null) "sudo -u postgres psql -h ${profile.postgresqlDatabasesPauseReplicationHost} -c 'SELECT pg_wal_replay_resume();' >/dev/null";
+          };
+          storage = {
+            encryption_passphrase = profile.password;
+            ssh_command = "ssh -i ${config.secrets.fullPaths."borg_backup/identity"}";
+            compression = "zlib";
+            borg_base_directory = "${varDir}/${profile.bucket}";
+            relocated_repo_access_is_ok = true;
+          };
+          retention = {
+            keep_within = "10d";
+            keep_daily = 30;
+          };
+        };
+      in
+      {
+        imports = [
+          environment.nixosModule
+          secrets.nixosModule
+        ];
+        options = {
+          services.borgBackup.enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Whether to enable remote backups.
+            '';
+          };
+          services.borgBackup.helpers = lib.mkOption {
+            readOnly = true;
+            description = ''
+              Some useful functions for borgBackup configuration
+            '';
+            default = {
+              mysqlDBFromBackup = name: primary: {
+                inherit name;
+                options = "--defaults-file=${config.secrets.fullPaths."mysql_replication/${primary}/mysqldump"} -S /run/mysqld_${primary}/mysqld.sock";
+              };
+              psqlDBWithSocket = name: socket: {
+                inherit name;
+                # do not use "host" otherwise it screws the path computation:
+                # there’s a python code os.path.join(os.path.expanduser(dump_path), hostname or 'localhost', name)
+                # and the first argument gets ignored since the second one
+                # looks like an absolute path
+                options = "--host ${socket}";
+                pg_dump_command = "sudo -u postgres pg_dump";
+                psql_command = "sudo -u postgres psql";
+                pg_restore_command = "sudo -u postgres pg_restore";
+              };
+            };
+          };
+          services.borgBackup.profiles = lib.mkOption {
+            type = lib.types.attrsOf (lib.types.submodule {
+              options = {
+                hash = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                  description = ''
+                    Hash bucket and directory names
+                  '';
+                };
+                rootDir = lib.mkOption {
+                  type = lib.types.path;
+                  default = "/var/lib";
+                  description = ''
+                    Path to backup
+                    '';
+                };
+                password = lib.mkOption {
+                  type = lib.types.str;
+                  default = cfg.password;
+                  description = ''
+                    password to use to encrypt data
+                  '';
+                };
+                directoriesMustExist = lib.mkOption {
+                  type = lib.types.bool;
+                  default = true;
+                  description = ''
+                    Raise error if backuped directory doesn't exist
+                  '';
+                };
+                bucket = lib.mkOption {
+                  type = lib.types.str;
+                  description = ''
+                    Bucket to use
+                    '';
+                };
+                remotes = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  description = ''
+                    Remotes to use for backup
+                    '';
+                };
+                includedPaths = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [];
+                  description = ''
+                    Included paths (subdirs of rootDir)
+                  '';
+                };
+                mariaDBDatabases = lib.mkOption {
+                  type = lib.types.listOf (lib.types.attrsOf lib.types.str);
+                  default = [];
+                  description = ''
+                    MariaDB databases to backup
+                  '';
+                };
+                postgresqlDatabasesPauseReplicationHost = lib.mkOption {
+                  type = lib.types.nullOr lib.types.str;
+                  default = null;
+                  description = ''
+                    Replicatino host to pause before the backup
+                  '';
+                };
+                postgresqlDatabases = lib.mkOption {
+                  type = lib.types.listOf (lib.types.attrsOf lib.types.str);
+                  default = [];
+                  description = ''
+                    Postgresql databases to backup
+                  '';
+                };
+                excludeFile = lib.mkOption {
+                  type = lib.types.lines;
+                  default = "";
+                  description = ''
+                    Content to put in exclude file
+                    '';
+                };
+                ignoredPaths = lib.mkOption {
+                  type = lib.types.listOf lib.types.str;
+                  default = [];
+                  description = ''
+                    List of paths to ignore when checking non-backed-up directories
+                    Can use (POSIX extended) regex
+                  '';
+                };
+              };
+            });
+          };
+        };
+        config = lib.mkIf config.services.borgBackup.enable {
+          system.activationScripts.borg_backup = ''
+            install -m 0700 -o root -g root -d ${varDir}
+            '';
+          secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (k: v:
+            let
+              bucket = if v.hash or true then builtins.hashString "sha256" v.bucket else v.bucket;
+            in map (remote: [
+              (lib.nameValuePair "borg_backup/${remote}_${k}/borgmatic.yaml" {
+                permissions = "0400";
+                text = borgProfile v remote bucket;
+              })
+              (lib.nameValuePair "borg_backup/${remote}_${k}" {
+                permissions = "0700";
+                isDir = true;
+              })
+          ]) v.remotes) config.services.borgBackup.profiles)) // {
+            "borg_backup/identity" = {
+              permissions = "0400";
+              text = "{{ .ssl_keys.borg_backup }}";
+            };
+            "borg_backup/backuped_mysql_list" = {
+              permissions = "0400";
+              text = builtins.concatStringsSep "\n" (lib.concatMap (v: (builtins.map (b: b.name) v.mariaDBDatabases)) (builtins.attrValues config.services.borgBackup.profiles));
+            };
+            "borg_backup/backuped_psql_list" = {
+              permissions = "0400";
+              text = builtins.concatStringsSep "\n" (lib.concatMap (v: (builtins.map (b: b.name) v.postgresqlDatabases)) (builtins.attrValues config.services.borgBackup.profiles));
+            };
+            "borg_backup/ignored_list" = {
+              permissions = "0400";
+              text = let
+                  ignored = map
+                    (v: map (p: "${v.rootDir}/${p}") v.ignoredPaths)
+                    (builtins.attrValues config.services.borgBackup.profiles);
+                in builtins.concatStringsSep "\n" (lib.flatten ignored);
+            };
+            "borg_backup/backuped_list" = {
+              permissions = "0400";
+              text = let
+                  included = map
+                    (v: map (p: "${v.rootDir}/${p}") v.includedPaths)
+                    (builtins.attrValues config.services.borgBackup.profiles);
+                in builtins.concatStringsSep "\n" (lib.flatten included);
+            };
+          };
+          programs.ssh.knownHostsFiles = [
+            (pkgs.writeText
+              "borg_backup_known_hosts"
+              (builtins.concatStringsSep
+                "\n"
+                (builtins.filter
+                  (v: v != null)
+                  (builtins.map
+                    (v: v.sshKnownHosts)
+                    (builtins.attrValues cfg.remotes)
+                  )
+                )
+              )
+            )
+          ];
+          environment.systemPackages = [ pkgs.borgbackup pkgs.borgmatic borg_backup_full_with_ignored borg_backup check_backups ] ++ (lib.optionals (name == "backup-2") [ check_mysql_backups check_psql_backups ]);
+          services.cron = {
+            enable = true;
+            systemCronJobs = [
+              "0 0 * * * root ${borg_backup}/bin/borg_backup 300"
+            ];
+          };
+        };
+      };
+  };
+}
diff --git a/systems/backup-2/base.nix b/systems/backup-2/base.nix
index 97a364c..61eecc9 100644
--- a/systems/backup-2/base.nix
+++ b/systems/backup-2/base.nix
@@ -92,6 +92,8 @@
    };
  };
+  services.borgBackup.enable = true;
  services.rsyncBackup = {
    mountpoint = "/backup2";
    profiles = config.myEnv.rsync_backup.profiles;
@@ -99,6 +101,13 @@
    ssh_key_private = config.secrets.fullPaths."rsync_backup/identity";
  };
+  services.borgBackup.profiles.global = {
+    bucket = "global";
+    hash = false;
+    remotes = [ "attilax" ];
+    rootDir = "/backup2/eldiron";
+    includedPaths = [ "databases_latest_backups" ];
+  };
  myServices.mailRelay.enable = true;
  myServices.mailBackup.enable = true;
  myServices.monitoring.enable = true;
diff --git a/systems/backup-2/databases/mariadb_replication.nix b/systems/backup-2/databases/mariadb_replication.nix
index f113219..c085682 100644
--- a/systems/backup-2/databases/mariadb_replication.nix
+++ b/systems/backup-2/databases/mariadb_replication.nix
@@ -163,6 +163,9 @@ in
                --flush-privileges \
                --all-databases > $filename
              ${pkgs.gzip}/bin/gzip $filename
+              mkdir -p "${cfg.base}/${name}/databases_latest_backups"
+              ln -f "$filename.gz" "${cfg.base}/${name}/databases_latest_backups/mysql.sql.gz"
            '';
          u = pkgs.callPackage ./utils.nix {};
          cleanup_script = pkgs.writeScript "cleanup_mysql_${name}" (u.exponentialDumps "sql.gz" backupDir);
@@ -194,7 +197,7 @@ in
      }
    ) cfg.hosts;
-    environment.systemPackages = lib.mapAttrsToList (name: hcfg:
+    environment.systemPackages = [ pkgs.mariadb ] ++ lib.mapAttrsToList (name: hcfg:
      pkgs.writeScriptBin "mysql_backup_${name}" ''
        #!${pkgs.stdenv.shell}
diff --git a/systems/backup-2/databases/openldap_replication.nix b/systems/backup-2/databases/openldap_replication.nix
index b962224..d3cda1c 100644
--- a/systems/backup-2/databases/openldap_replication.nix
+++ b/systems/backup-2/databases/openldap_replication.nix
@@ -121,7 +121,11 @@ in
          backup_script = pkgs.writeScript "backup_openldap_${name}" ''
              #!${pkgs.stdenv.shell}
-              ${hcfg.package}/bin/slapcat -b "${hcfg.base}" -f ${ldapConfig hcfg name} -l ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).ldif
+              filename="${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).ldif"
+              ${hcfg.package}/bin/slapcat -b "${hcfg.base}" -f ${ldapConfig hcfg name} -l "$filename"
+              mkdir -p "${cfg.base}/${name}/databases_latest_backups"
+              ln -f "$filename" "${cfg.base}/${name}/databases_latest_backups/openldap.ldif"
            '';
          u = pkgs.callPackage ./utils.nix {};
          cleanup_script = pkgs.writeScript "cleanup_openldap_${name}" (u.exponentialDumps "ldif" backupDir);
diff --git a/systems/backup-2/databases/postgresql_replication.nix b/systems/backup-2/databases/postgresql_replication.nix
index 5351a4f..b428533 100644
--- a/systems/backup-2/databases/postgresql_replication.nix
+++ b/systems/backup-2/databases/postgresql_replication.nix
@@ -127,19 +127,23 @@ in
              set -euo pipefail
              resume_replication() {
-                ${hcfg.package}/bin/psql -h ${dataDir} -c "SELECT pg_wal_replay_resume();" >/dev/null || echo "impossible to resume replication"
+                sudo -u postgres ${hcfg.package}/bin/psql -h ${dataDir} -c "SELECT pg_wal_replay_resume();" >/dev/null || echo "impossible to resume replication"
              }
              trap resume_replication EXIT
-              ${hcfg.package}/bin/psql -h ${dataDir} -c "SELECT pg_wal_replay_pause();" >/dev/null || (echo "impossible to pause replication" && false)
+              sudo -u postgres ${hcfg.package}/bin/psql -h ${dataDir} -c "SELECT pg_wal_replay_pause();" >/dev/null || (echo "impossible to pause replication" && false)
-              ${hcfg.package}/bin/pg_dumpall -h ${dataDir} -f ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).sql
+              filename=${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).sql
+              sudo -u postgres ${hcfg.package}/bin/pg_dumpall -h ${dataDir} -f "$filename"
+              mkdir -p "${cfg.base}/${name}/databases_latest_backups"
+              ln -f "$filename" "${cfg.base}/${name}/databases_latest_backups/postgresql.sql"
            '';
          u = pkgs.callPackage ./utils.nix {};
          cleanup_script = pkgs.writeScript "cleanup_postgresql_${name}" (u.keepLastNDumps "sql" backupDir 6);
        in [
-          "0 22,4,10,16 * * * postgres ${backup_script}"
+          "0 22,4,10,16 * * * root ${backup_script}"
          "0 3 * * * postgres ${cleanup_script}"
        ]) cfg.hosts);
    };
diff --git a/systems/backup-2/databases/redis_replication.nix b/systems/backup-2/databases/redis_replication.nix
index 53fa904..1088630 100644
--- a/systems/backup-2/databases/redis_replication.nix
+++ b/systems/backup-2/databases/redis_replication.nix
@@ -114,8 +114,11 @@ in
          backup_script = pkgs.writeScript "backup_redis_${name}" ''
              #!${pkgs.stdenv.shell}
-              ${pkgs.coreutils}/bin/cp ${cfg.base}/${name}/redis/dump.rdb \
+              filename="${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).rdb"
-                ${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).rdb
+              ${pkgs.coreutils}/bin/cp ${cfg.base}/${name}/redis/dump.rdb "$filename"
+              mkdir -p "${cfg.base}/${name}/databases_latest_backups"
+              ln -f "$filename" "${cfg.base}/${name}/databases_latest_backups/redis.rdb"
            '';
          u = pkgs.callPackage ./utils.nix {};
          cleanup_script = pkgs.writeScript "cleanup_redis_${name}" (u.exponentialDumps "rdb" backupDir);
diff --git a/systems/backup-2/flake.lock b/systems/backup-2/flake.lock
index 2eee849..2e5b9b2 100644
--- a/systems/backup-2/flake.lock
+++ b/systems/backup-2/flake.lock
@@ -16,9 +16,25 @@
        "type": "path"
      }
    },
+    "borg-backup": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "chatons": {
      "inputs": {
-        "environment": "environment"
+        "environment": "environment_2"
      },
      "locked": {
        "lastModified": 1,
@@ -87,11 +103,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      },
      "original": {
-        "path": "../../flakes/private/environment",
+        "path": "../environment",
        "type": "path"
      }
    },
@@ -99,11 +115,11 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      },
      "original": {
-        "path": "../environment",
+        "path": "../../flakes/private/environment",
        "type": "path"
      }
    },
@@ -155,6 +171,18 @@
        "type": "path"
      }
    },
+    "environment_8": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
    "files-watcher": {
      "locked": {
        "lastModified": 1,
@@ -347,8 +375,8 @@
    },
    "mail-relay": {
      "inputs": {
-        "environment": "environment_3",
+        "environment": "environment_4",
-        "secrets": "secrets"
+        "secrets": "secrets_2"
      },
      "locked": {
        "lastModified": 1,
@@ -363,11 +391,11 @@
    },
    "milters": {
      "inputs": {
-        "environment": "environment_4",
+        "environment": "environment_5",
        "files-watcher": "files-watcher",
        "openarc": "openarc",
        "opendmarc": "opendmarc",
-        "secrets": "secrets_2"
+        "secrets": "secrets_3"
      },
      "locked": {
        "lastModified": 1,
@@ -382,10 +410,10 @@
    },
    "monitoring": {
      "inputs": {
-        "environment": "environment_5",
+        "environment": "environment_6",
        "naemon": "naemon",
        "nixpkgs-lib": "nixpkgs-lib",
-        "secrets": "secrets_3"
+        "secrets": "secrets_4"
      },
      "locked": {
        "lastModified": 1,
@@ -852,7 +880,7 @@
      "inputs": {
        "files-watcher": "files-watcher_2",
        "openarc": "openarc_4",
-        "secrets": "secrets_4"
+        "secrets": "secrets_5"
      },
      "locked": {
        "lastModified": 1,
@@ -918,10 +946,10 @@
    },
    "opendmarc_2": {
      "inputs": {
-        "environment": "environment_6",
+        "environment": "environment_7",
        "files-watcher": "files-watcher_3",
        "opendmarc": "opendmarc_3",
-        "secrets": "secrets_5"
+        "secrets": "secrets_6"
      },
      "locked": {
        "lastModified": 1,
@@ -965,8 +993,9 @@
    },
    "root": {
      "inputs": {
+        "borg-backup": "borg-backup",
        "chatons": "chatons",
-        "environment": "environment_2",
+        "environment": "environment_3",
        "loginctl-linger": "loginctl-linger",
        "mail-relay": "mail-relay",
        "milters": "milters",
@@ -978,7 +1007,7 @@
        "opendmarc": "opendmarc_2",
        "openldap": "openldap",
        "rsync_backup": "rsync_backup",
-        "secrets": "secrets_6",
+        "secrets": "secrets_7",
        "system": "system"
      }
    },
@@ -1070,6 +1099,18 @@
      "locked": {
        "lastModified": 1,
        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
+    "secrets_7": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
        "path": "../../flakes/secrets",
        "type": "path"
      },
@@ -1097,7 +1138,7 @@
    "system": {
      "inputs": {
        "backports": "backports",
-        "environment": "environment_7",
+        "environment": "environment_8",
        "mypackages": "mypackages",
        "myuids": "myuids_6",
        "secrets-public": "secrets-public"
diff --git a/systems/backup-2/flake.nix b/systems/backup-2/flake.nix
index e6807d6..f172b59 100644
--- a/systems/backup-2/flake.nix
+++ b/systems/backup-2/flake.nix
@@ -4,6 +4,7 @@
    my-lib.url = "path:../../flakes/lib";
+    borg-backup.url = "path:../../flakes/private/borg_backup";
    openldap.url = "path:../../flakes/private/openldap";
    monitoring.url = "path:../../flakes/private/monitoring";
    mail-relay.url = "path:../../flakes/private/mail-relay";
@@ -41,6 +42,7 @@
        secrets = inputs.secrets.nixosModule;
        rsync_backup = inputs.rsync_backup.nixosModule;
        loginctl-linger = inputs.loginctl-linger.nixosModule;
+        borg-backup = inputs.borg-backup.nixosModule;
      };
      moduleArgs = {
        nixpkgs = inputs.nixpkgs;
diff --git a/systems/eldiron/base.nix b/systems/eldiron/base.nix
index 4535dcf..4546212 100644
--- a/systems/eldiron/base.nix
+++ b/systems/eldiron/base.nix
@@ -118,7 +118,6 @@
    ./buildbot
    ./coturn.nix
    ./dns.nix
-    ./borg_backup.nix
    ./duply_backup.nix
    ./gemini
    ./gitolite
diff --git a/systems/eldiron/borg_backup.nix b/systems/eldiron/borg_backup.nix
deleted file mode 100644
index f83594a..0000000
--- a/systems/eldiron/borg_backup.nix
+++ /dev/null
@@ -1,242 +0,0 @@
-{ lib, pkgs, config, name, ... }:
-let
-  cfg = config.myEnv.borg_backup;
-  varDir = "/var/lib/borgbackup";
-  borg_args = "--encryption repokey --make-parent-dirs init create prune compact check";
-  borg_backup_full_with_ignored = pkgs.writeScriptBin "borg_full_with_ignored" ''
-    #!${pkgs.stdenv.shell}
-    if [ -z "$1" -o "$1" = "-h" -o "$1" = "--help" ]; then
-      echo "borg_full_with_ignored /path/to/borgmatic.yaml"
-      echo "Does a full backup including directories with .duplicity-ignore"
-      exit 1
-    fi
-    ${pkgs.borgmatic}/bin/borgmatic -c "$1" --override 'storage.archive_name_format="{hostname}-with-ignored-{now:%Y-%m-%dT%H:%M:%S.%f}"' --override 'location.exclude_if_present=[]' ${borg_args}
-  '';
-  borg_backup = pkgs.writeScriptBin "borg_backup" ''
-    #!${pkgs.stdenv.shell}
-    declare -a profiles
-    profiles=()
-    ${builtins.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList (k: v: map (remote: [
-      ''profiles+=("${remote}_${k}")''
-    ]) v.remotes) config.services.borgBackup.profiles))}
-    if [ -f "${varDir}/last_backup_profile" ]; then
-      last_backup=$(cat ${varDir}/last_backup_profile)
-      for i in "''${!profiles[@]}"; do
-        if [[ "''${profiles[$i]}" = "$last_backup" ]]; then
-          break
-        fi
-      done
-      ((i+=1))
-      profiles=("''${profiles[@]:$i}" "''${profiles[@]:0:$i}")
-    fi
-    # timeout in minutes
-    timeout="''${1:-180}"
-    timeout_timestamp=$(date +%s -d "$timeout minutes")
-    for profile in "''${profiles[@]}"; do
-      if [ $(date +%s -d "now") -ge "$timeout_timestamp" ]; then
-        break
-      fi
-      touch "${varDir}/$profile.log"
-      ${pkgs.borgmatic}/bin/borgmatic -c "${config.secrets.location}/borg_backup/$profile/borgmatic.yaml" ${borg_args} >> ${varDir}/$profile.log
-      [[ $? = 0 ]] || echo -e "Error when doing backup for $profile, see above or logs in ${varDir}/$profile.log\n---------------------------------------" >&2
-      echo "$profile" > ${varDir}/last_backup_profile
-    done
-  '';
-  check_backups = pkgs.writeScriptBin "borg_list_not_backuped" ''
-    #!${pkgs.stdenv.shell}
-    do_check() {
-      local dir="$1" path ignored_path
-      find "$dir" -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
-        if ${pkgs.gnugrep}/bin/grep -qFx "$path" ${config.secrets.fullPaths."borg_backup/backuped_list"}; then
-          continue
-        elif ${pkgs.gnugrep}/bin/grep -q "^$path/" ${config.secrets.fullPaths."borg_backup/backuped_list"}; then
-          do_check "$path"
-        else
-          while IFS= read -r ignored_path; do
-            if [[ "$path" =~ ^$ignored_path$ ]]; then
-              continue 2
-            fi
-          done < ${config.secrets.fullPaths."borg_backup/ignored_list"}
-          printf '%s\n' "$path"
-        fi
-      done
-    }
-    do_check /var/lib
-  '';
-  borgProfile = profile: remote: bucket: builtins.toJSON {
-    location = {
-      source_directories = map (p: "${profile.rootDir}/${p}") profile.includedPaths;
-      repositories = [
-        { path = cfg.remotes.${remote}.remote name bucket; label = "backupserver"; }
-      ];
-      one_file_system = false;
-      exclude_if_present = [".duplicity-ignore"];
-      source_directories_must_exist = profile.directoriesMustExist;
-      borgmatic_source_directory = "${varDir}/${profile.bucket}/.borgmatic";
-    };
-    storage = {
-      encryption_passphrase = profile.password;
-      ssh_command = "ssh -i ${config.secrets.fullPaths."borg_backup/identity"}";
-      compression = "zlib";
-      borg_base_directory = "${varDir}/${profile.bucket}";
-      relocated_repo_access_is_ok = true;
-    };
-    retention = {
-      keep_within = "10d";
-      keep_daily = 30;
-    };
-  };
-in
-{
-  options = {
-    services.borgBackup.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Whether to enable remote backups.
-      '';
-    };
-    services.borgBackup.profiles = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule {
-        options = {
-          hash = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Hash bucket and directory names
-            '';
-          };
-          rootDir = lib.mkOption {
-            type = lib.types.path;
-            default = "/var/lib";
-            description = ''
-              Path to backup
-              '';
-          };
-          password = lib.mkOption {
-            type = lib.types.str;
-            default = cfg.password;
-            description = ''
-              password to use to encrypt data
-            '';
-          };
-          directoriesMustExist = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Raise error if backuped directory doesn't exist
-            '';
-          };
-          bucket = lib.mkOption {
-            type = lib.types.str;
-            description = ''
-              Bucket to use
-              '';
-          };
-          remotes = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            description = ''
-              Remotes to use for backup
-              '';
-          };
-          includedPaths = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            default = [];
-            description = ''
-              Included paths (subdirs of rootDir)
-            '';
-          };
-          excludeFile = lib.mkOption {
-            type = lib.types.lines;
-            default = "";
-            description = ''
-              Content to put in exclude file
-              '';
-          };
-          ignoredPaths = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            default = [];
-            description = ''
-              List of paths to ignore when checking non-backed-up directories
-              Can use (POSIX extended) regex
-            '';
-          };
-        };
-      });
-    };
-  };
-  config = lib.mkIf config.services.borgBackup.enable {
-    system.activationScripts.borg_backup = ''
-      install -m 0700 -o root -g root -d ${varDir}
-      '';
-    secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (k: v:
-      let
-        bucket = if v.hash or true then builtins.hashString "sha256" v.bucket else v.bucket;
-      in map (remote: [
-        (lib.nameValuePair "borg_backup/${remote}_${k}/borgmatic.yaml" {
-          permissions = "0400";
-          text = borgProfile v remote bucket;
-        })
-        (lib.nameValuePair "borg_backup/${remote}_${k}" {
-          permissions = "0700";
-          isDir = true;
-        })
-    ]) v.remotes) config.services.borgBackup.profiles)) // {
-      "borg_backup/identity" = {
-        permissions = "0400";
-        text = "{{ .ssl_keys.borg_backup }}";
-      };
-      "borg_backup/ignored_list" = {
-        permissions = "0400";
-        text = let
-            ignored = map
-              (v: map (p: "${v.rootDir}/${p}") v.ignoredPaths)
-              (builtins.attrValues config.services.borgBackup.profiles);
-          in builtins.concatStringsSep "\n" (lib.flatten ignored);
-      };
-      "borg_backup/backuped_list" = {
-        permissions = "0400";
-        text = let
-            included = map
-              (v: map (p: "${v.rootDir}/${p}") v.includedPaths)
-              (builtins.attrValues config.services.borgBackup.profiles);
-          in builtins.concatStringsSep "\n" (lib.flatten included);
-      };
-    };
-    programs.ssh.knownHostsFiles = [
-      (pkgs.writeText
-        "borg_backup_known_hosts"
-        (builtins.concatStringsSep
-          "\n"
-          (builtins.filter
-            (v: v != null)
-            (builtins.map
-              (v: v.sshKnownHosts)
-              (builtins.attrValues cfg.remotes)
-            )
-          )
-        )
-      )
-    ];
-    environment.systemPackages = [ pkgs.borgbackup pkgs.borgmatic borg_backup_full_with_ignored borg_backup check_backups ];
-    services.cron = {
-      enable = true;
-      systemCronJobs = [
-        "0 0 * * * root ${borg_backup}/bin/borg_backup 300"
-      ];
-    };
-  };
-}
diff --git a/systems/eldiron/flake.lock b/systems/eldiron/flake.lock
index ac6307e..5922ea2 100644
--- a/systems/eldiron/flake.lock
+++ b/systems/eldiron/flake.lock
@@ -198,6 +198,18 @@
        "type": "path"
      }
    },
+    "environment_7": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
    "etherpad-lite": {
      "flake": false,
      "locked": {
@@ -1966,6 +1978,22 @@
        "type": "path"
      }
    },
+    "private-borg-backup": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      },
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-6IB+N7TeH+3XyK8nwlEX4LGl3EJJLVoESteotut3OUc=",
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../flakes/private/borg_backup",
+        "type": "path"
+      }
+    },
    "private-buildbot": {
      "inputs": {
        "buildslist": "buildslist",
@@ -1985,7 +2013,7 @@
    },
    "private-chatons": {
      "inputs": {
-        "environment": "environment"
+        "environment": "environment_2"
      },
      "locked": {
        "lastModified": 1,
@@ -2012,11 +2040,11 @@
    },
    "private-milters": {
      "inputs": {
-        "environment": "environment_2",
+        "environment": "environment_3",
        "files-watcher": "files-watcher",
        "openarc": "openarc",
        "opendmarc": "opendmarc",
-        "secrets": "secrets"
+        "secrets": "secrets_2"
      },
      "locked": {
        "lastModified": 1,
@@ -2031,10 +2059,10 @@
    },
    "private-monitoring": {
      "inputs": {
-        "environment": "environment_3",
+        "environment": "environment_4",
        "naemon": "naemon",
        "nixpkgs-lib": "nixpkgs-lib_2",
-        "secrets": "secrets_2"
+        "secrets": "secrets_3"
      },
      "locked": {
        "lastModified": 1,
@@ -2051,7 +2079,7 @@
      "inputs": {
        "files-watcher": "files-watcher_2",
        "openarc": "openarc_3",
-        "secrets": "secrets_3"
+        "secrets": "secrets_4"
      },
      "locked": {
        "lastModified": 1,
@@ -2066,10 +2094,10 @@
    },
    "private-opendmarc": {
      "inputs": {
-        "environment": "environment_4",
+        "environment": "environment_5",
        "files-watcher": "files-watcher_3",
        "opendmarc": "opendmarc_2",
-        "secrets": "secrets_4"
+        "secrets": "secrets_5"
      },
      "locked": {
        "lastModified": 1,
@@ -2129,8 +2157,8 @@
    },
    "private-ssh": {
      "inputs": {
-        "environment": "environment_5",
+        "environment": "environment_6",
-        "secrets": "secrets_5"
+        "secrets": "secrets_6"
      },
      "locked": {
        "lastModified": 1,
@@ -2146,7 +2174,7 @@
    "private-system": {
      "inputs": {
        "backports": "backports",
-        "environment": "environment_6",
+        "environment": "environment_7",
        "mypackages": "mypackages",
        "myuids": "myuids_7",
        "secrets-public": "secrets-public"
@@ -2471,6 +2499,7 @@
        "dns-nix": "dns-nix",
        "my-lib": "my-lib",
        "nixpkgs": "nixpkgs_5",
+        "private-borg-backup": "private-borg-backup",
        "private-buildbot": "private-buildbot",
        "private-chatons": "private-chatons",
        "private-environment": "private-environment",
@@ -2576,6 +2605,18 @@
        "type": "path"
      }
    },
+    "secrets_6": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    },
    "stable": {
      "locked": {
        "lastModified": 1669735802,
diff --git a/systems/eldiron/flake.nix b/systems/eldiron/flake.nix
index 205571f..3561a5c 100644
--- a/systems/eldiron/flake.nix
+++ b/systems/eldiron/flake.nix
@@ -26,6 +26,7 @@
    public-paste.url = "path:../../flakes/paste";
    public-taskwarrior-web.url = "path:../../flakes/taskwarrior-web";
+    private-borg-backup.url = "path:../../flakes/private/borg_backup";
    private-peertube.url = "path:../../flakes/private/peertube";
    private-buildbot.url = "path:../../flakes/private/buildbot";
    private-ports.url = "path:../../flakes/private/ports";
@@ -69,6 +70,7 @@
        system = private-system.nixosModule;
        monitoring = private-monitoring.nixosModule;
        milters = private-milters.nixosModule;
+        borg-backup = private-borg-backup.nixosModule;
      };
      moduleArgs = with inputs; {
        dns-nix = dns-nix;