diff --git a/modules/features/restic.nix b/modules/features/restic.nix
index 8695b29..a739d8b 100644
--- a/modules/features/restic.nix
+++ b/modules/features/restic.nix
@@ -1,12 +1,67 @@
 { self, inputs, ... }: {
-  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }: {
-    services.restic.server = {
-      enable = true;
-      dataDir = "/mnt/restic";
-      listenAddress = "0.0.0.0:8080";
-      extraFlags = [ "--no-auth" ];
+  flake.modules.nixos.restic-server = { config, pkgs, lib, ... }:
+    let
+      cfg = config.resticServer;
+      port = builtins.fromJSON (lib.last (lib.splitString ":" cfg.listenAddress));
+    in {
+      options.resticServer = {
+        enable = lib.mkEnableOption "Enable the RESTic REST server";
+
+        dataDir = lib.mkOption {
+          description = "Storage directory for RESTic repositories served by this host.";
+          type = lib.types.str;
+          default = "/mnt/restic";
+        };
+
+        listenAddress = lib.mkOption {
+          description = "Listen address for the RESTic REST server.";
+          type = lib.types.str;
+          default = "0.0.0.0:8080";
+        };
+
+        privateRepos = lib.mkOption {
+          description = "Whether the RESTic server should use private repository mode.";
+          type = lib.types.bool;
+          default = true;
+        };
+
+        extraFlags = lib.mkOption {
+          description = "Additional flags to pass to the RESTic REST server before TLS flags are appended.";
+          type = lib.types.listOf lib.types.str;
+          default = [ "--no-auth" ];
+        };
+
+        tls = {
+          certFile = lib.mkOption {
+            description = "Path to the TLS certificate file for the RESTic REST server, or null to disable TLS.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+
+          keyFile = lib.mkOption {
+            description = "Path to the TLS private key file for the RESTic REST server, or null to disable TLS.";
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+          };
+        };
+      };
+
+      config = lib.mkIf cfg.enable {
+        networking.firewall.allowedTCPPorts = [ port ];
+
+        services.restic.server = {
+          enable = true;
+          inherit (cfg) dataDir listenAddress privateRepos;
+          extraFlags =
+            cfg.extraFlags
+            ++ lib.optionals (cfg.tls.certFile != null && cfg.tls.keyFile != null) [
+              "--tls"
+              "--tls-cert=${cfg.tls.certFile}"
+              "--tls-key=${cfg.tls.keyFile}"
+            ];
+        };
+      };
     };
-  };
 
   flake.modules.homeManager.restic = { config, pkgs, lib, ... }:
     let
diff --git a/modules/hosts/soteria/default.nix b/modules/hosts/soteria/default.nix
index 4cfd567..1ebbc78 100644
--- a/modules/hosts/soteria/default.nix
+++ b/modules/hosts/soteria/default.nix
@@ -16,7 +16,7 @@ in
       nixos.mtls
       nixos.janus-ca
       nixos.forgejo
-      # nixos.restic-server
+      nixos.restic-server
       # nixos.restic-envoy
       ({ config, pkgs, ... }: {
         networking.hostName = hostname;
@@ -58,17 +58,15 @@ in
           port = 443;
         };
 
-        networking.firewall.allowedTCPPorts = [ 8000 ];
-        services.restic.server = {
+        resticServer = {
           enable = true;
+          dataDir = "/mnt/restic";
           privateRepos = true;
           listenAddress = "0.0.0.0:8000";
-          extraFlags = [
-            "--no-auth"
-            "--tls"
-            "--tls-cert=${config.mtls.certFile}"
-            "--tls-key=${config.mtls.keyFile}"
-          ];
+          tls = {
+            certFile = config.mtls.certFile;
+            keyFile = config.mtls.keyFile;
+          };
         };
 
         loginText.extraServiceStatus = {