restic mtls opts

modules/services/restic/restic.nix

@@ -34,15 +34,17 @@
           RESTIC_TLS_CLIENT_CERT = mtlsClientCert;
         };
         
+        # This is necessary because the restic service in home manager doesn't otherwise expose these options.
+        systemd.user.services."restic-backups-${cfg.repoName}".Service.Environment = [
+          "RESTIC_CACERT=${caCert}"
+          "RESTIC_TLS_CLIENT_CERT=${mtlsClientCert}"
+        ];
+
         services.restic = {
           enable = true;
           backups.${cfg.repoName} = {
             repository = resticRepository;
             passwordFile = cfg.passwordFile;
-            extraBackupArgs = [
-              "--tls-client-cert ${mtlsClientCert}"
-              "--cacert ${caCert}"
-            ];
             paths = cfg.paths;
             timerConfig = {
               OnCalendar = "00:05";
@@ -83,6 +85,7 @@
             ];
           };
         };
+
       };
     };
 }