{...}: {
  services.borgbackup = {
    repos = {
      backups = {
        allowSubRepos = true;
        authorizedKeys = [
          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEMtbHUcYanH/guWaKNjGr/IGa8gvI/xRTcNAI9yXhnK BorgBackup backups key"
        ];
      };
    };
  };
  services.openssh.settings = {
    AllowUsers = [
      "borg@*.tailscale"
      "borg@192.168.1.0/24"
      "borg@localhost"
    ];
  };
}