services.tarsnap.archives.<name>.keyfile

Set a specific keyfile for this archive. This defaults to "/root/tarsnap.key" if left unspecified.

Use this option if you want to run multiple backups concurrently - each archive must have a unique key. You can generate a write-only key derived from your master key (which is recommended) using tarsnap-keymgmt(1).

Note: every archive must have an individual master key. You must generate multiple keys with tarsnap-keygen(1), and then generate write only keys from those.

The keyfile name should be given as a string and not a path, to avoid the key being copied into the Nix store.