{config, ...}: let
  pastePort = 8087;
in {
  age.secrets."hidden_service/microbin".file = ../secrets/hidden_service/microbin;

  services = {
    microbin = {
      enable = true;
      settings = {
        MICROBIN_PORT = pastePort;
        MICROBIN_ENABLE_BURN_AFTER = true;
        MICROBIN_QR = true;
        MICROBIN_NO_LISTING = true;
        MICROBIN_HIGHLIGHTSYNTAX = true;
        MICROBIN_PUBLIC_PATH = "https://paste.distrust.network/";
      };
    };
    borgbackup.jobs."microbin" = {
      repo = "ssh://u506783@u506783.your-storagebox.de:23/./microbin";
      environment = {
        BORG_RSH = "ssh -i ${config.age.secrets."borg_ed25519".path} -o 'StrictHostKeyChecking=no'";
      };
      paths = [
        "/var/lib/microbin"
      ];
      encryption = {
        mode = "keyfile";
        passCommand = "cat ${config.age.secrets."borg_pass".path}";
      };
      compression = "auto,lzma";
      startAt = "daily";
      prune.keep = {
        daily = 7;
        weekly = 4;
        monthly = -1;
      };
    };
  };

  distrust.services."microbin" = {
    url = "https://paste.distrust.network";
    onion = {
      url = "http://s4h5nfnwwhzku55opxlqouobioibx4htwygnp2l4fkp256lur5s53rad.onion";
      secretKey = config.age.secrets."hidden_service/microbin".path;
    };
    virtualHostConfig = ''
      reverse_proxy localhost:${toString pastePort}
    '';
  };
}