NixOS fortunately solves this problem. Here's a daily rsync with some names changed to protect any innocent hosts on my network. Note that the contents of "sync.sh" could easily go in there as well, but I was previously running it via cron, so didn't bother to move that over.

  systemd.services.somehost-sync = {
    startAt = "daily";
    path = [ pkgs.coreutils pkgs.rsync pkgs.openssh ];
    environment = {
      HOME = "/home/someuser";
    };
    script = ''/external/media/sync.sh'';
    serviceConfig.User = "someuser";
  };

Not everything in NixOS has been a "win" but systemd timers are so much more ergonomic under nix