config/modules/services/borgstor/default.nix

{
  config,
  lib,
  myData,
  pkgs,
  ...
}: {
  options.mj.services.borgstor = with lib.types; {
    enable = lib.mkEnableOption "Enable borg storage user";
    dataDir = lib.mkOption {type = path;};
    sshKeys = lib.mkOption {type = listOf str;};
  };

  config = with config.mj.services.borgstor;
    lib.mkIf enable {
      users.users.borgstor = {
        description = "Borg Storage";
        home = dataDir;
        shell = "/bin/sh";
        group = "borgstor";
        isSystemUser = true;
        createHome = false;
        uid = myData.uidgid.borgstor;
        openssh.authorizedKeys.keys =
          map (
            k: "command=\"${pkgs.borgbackup}/bin/borg serve --restrict-to-path ${dataDir}\",restrict ${k}"
          )
          sshKeys;
      };

      users.groups.borgstor.gid = myData.uidgid.borgstor;
    };
}