nixos/borgbackup: replace activationScript via tmpfiles

  };

  # Paths listed in ReadWritePaths must exist before service is started

  mkActivationScript = name: cfg:

  mkTmpfiles = name: cfg:

    let

      install = "install -o ${cfg.user} -g ${cfg.group}";

    in

      nameValuePair "borgbackup-job-${name}" (stringAfter [ "users" ] (''

        # Ensure that the home directory already exists

        # We can't assert createHome == true because that's not the case for root

        cd "${config.users.users.${cfg.user}.home}"

        # Create each directory separately to prevent root owned parent dirs

        ${install} -d .config .config/borg

        ${install} -d .cache .cache/borg

      '' + optionalString (isLocalPath cfg.repo && !cfg.removableDevice) ''

        ${install} -d ${escapeShellArg cfg.repo}

      ''));

      settings = { inherit (cfg) user group; };

    in lib.nameValuePair "borgbackup-job-${name}" ({

      "${config.users.users."${cfg.user}".home}/.config/borg".d = settings;

      "${config.users.users."${cfg.user}".home}/.cache/borg".d = settings;

    } // optionalAttrs (isLocalPath cfg.repo && !cfg.removableDevice) {

      "${cfg.repo}".d = settings;

    });

  mkPassAssertion = name: cfg: {

    assertion = with cfg.encryption;

        ++ mapAttrsToList mkSourceAssertions jobs

        ++ mapAttrsToList mkRemovableDeviceAssertions jobs;

      system.activationScripts = mapAttrs' mkActivationScript jobs;

      systemd.tmpfiles.settings = mapAttrs' mkTmpfiles jobs;

      systemd.services =

        # A job named "foo" is mapped to systemd.services.borgbackup-job-foo