diff --git a/nixos/modules/services/network-filesystems/litestream/default.nix b/nixos/modules/services/network-filesystems/litestream/default.nix
index 884ffa50e7c6..24ac3130f36c 100644
--- a/nixos/modules/services/network-filesystems/litestream/default.nix
+++ b/nixos/modules/services/network-filesystems/litestream/default.nix
@@ -94,5 +94,8 @@ in
     };
     users.groups.litestream = {};
   };
+
+  # Don't edit the docbook xml directly, edit the md and generate it:
+  # `pandoc litestream.md -t docbook --top-level-division=chapter --extract-media=media -f markdown-smart --lua-filter ../../../../../doc/build-aux/pandoc-filters/myst-reader/roles.lua --lua-filter ../../../../../doc/build-aux/pandoc-filters/docbook-writer/rst-roles.lua > litestream.xml`
   meta.doc = ./litestream.xml;
 }
diff --git a/nixos/modules/services/network-filesystems/litestream/litestream.md b/nixos/modules/services/network-filesystems/litestream/litestream.md
new file mode 100644
index 000000000000..8d8486507b77
--- /dev/null
+++ b/nixos/modules/services/network-filesystems/litestream/litestream.md
@@ -0,0 +1,52 @@
+# Litestream {#module-services-litestream}
+
+[Litestream](https://litestream.io/) is a standalone streaming
+replication tool for SQLite.
+
+## Configuration {#module-services-litestream-configuration}
+
+Litestream service is managed by a dedicated user named `litestream`
+which needs permission to the database file. Here's an example config which gives
+required permissions to access [grafana database](#opt-services.grafana.settings.database.path):
+```
+{ pkgs, ... }:
+{
+  users.users.litestream.extraGroups = [ "grafana" ];
+
+  systemd.services.grafana.serviceConfig.ExecStartPost = "+" + pkgs.writeShellScript "grant-grafana-permissions" ''
+    timeout=10
+
+    while [ ! -f /var/lib/grafana/data/grafana.db ];
+    do
+      if [ "$timeout" == 0 ]; then
+        echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+        exit 1
+      fi
+
+      sleep 1
+
+      ((timeout--))
+    done
+
+    find /var/lib/grafana -type d -exec chmod -v 775 {} \;
+    find /var/lib/grafana -type f -exec chmod -v 660 {} \;
+  '';
+
+  services.litestream = {
+    enable = true;
+
+    environmentFile = "/run/secrets/litestream";
+
+    settings = {
+      dbs = [
+        {
+          path = "/var/lib/grafana/data/grafana.db";
+          replicas = [{
+            url = "s3://mybkt.litestream.io/grafana";
+          }];
+        }
+      ];
+    };
+  };
+}
+```
diff --git a/nixos/modules/services/network-filesystems/litestream/litestream.xml b/nixos/modules/services/network-filesystems/litestream/litestream.xml
index 8f5597bb6891..6ea40c8bf474 100644
--- a/nixos/modules/services/network-filesystems/litestream/litestream.xml
+++ b/nixos/modules/services/network-filesystems/litestream/litestream.xml
@@ -1,34 +1,31 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="module-services-litestream">
- <title>Litestream</title>
- <para>
-  <link xlink:href="https://litestream.io/">Litestream</link> is a standalone streaming
-  replication tool for SQLite.
- </para>
-
- <section xml:id="module-services-litestream-configuration">
-  <title>Configuration</title>
-
+<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="module-services-litestream">
+  <title>Litestream</title>
   <para>
-   Litestream service is managed by a dedicated user named <literal>litestream</literal>
-   which needs permission to the database file. Here's an example config which gives
-   required permissions to access <link linkend="opt-services.grafana.settings.database.path">
-   grafana database</link>:
-<programlisting>
+    <link xlink:href="https://litestream.io/">Litestream</link> is a
+    standalone streaming replication tool for SQLite.
+  </para>
+  <section xml:id="module-services-litestream-configuration">
+    <title>Configuration</title>
+    <para>
+      Litestream service is managed by a dedicated user named
+      <literal>litestream</literal> which needs permission to the
+      database file. Here's an example config which gives required
+      permissions to access
+      <link linkend="opt-services.grafana.settings.database.path">grafana
+      database</link>:
+    </para>
+    <programlisting>
 { pkgs, ... }:
 {
-  users.users.litestream.extraGroups = [ "grafana" ];
+  users.users.litestream.extraGroups = [ &quot;grafana&quot; ];
 
-  systemd.services.grafana.serviceConfig.ExecStartPost = "+" + pkgs.writeShellScript "grant-grafana-permissions" ''
+  systemd.services.grafana.serviceConfig.ExecStartPost = &quot;+&quot; + pkgs.writeShellScript &quot;grant-grafana-permissions&quot; ''
     timeout=10
 
     while [ ! -f /var/lib/grafana/data/grafana.db ];
     do
-      if [ "$timeout" == 0 ]; then
-        echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+      if [ &quot;$timeout&quot; == 0 ]; then
+        echo &quot;ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db.&quot;
         exit 1
       fi
 
@@ -44,14 +41,14 @@
   services.litestream = {
     enable = true;
 
-    environmentFile = "/run/secrets/litestream";
+    environmentFile = &quot;/run/secrets/litestream&quot;;
 
     settings = {
       dbs = [
         {
-          path = "/var/lib/grafana/data/grafana.db";
+          path = &quot;/var/lib/grafana/data/grafana.db&quot;;
           replicas = [{
-            url = "s3://mybkt.litestream.io/grafana";
+            url = &quot;s3://mybkt.litestream.io/grafana&quot;;
           }];
         }
       ];
@@ -59,7 +56,5 @@
   };
 }
 </programlisting>
-  </para>
- </section>
-
+  </section>
 </chapter>