diff --git a/SwarselSystems.org b/SwarselSystems.org
index 53c57c3..681cc82 100644
--- a/SwarselSystems.org
+++ b/SwarselSystems.org
@@ -3461,6 +3461,7 @@ I usually use =mutableUsers = false= in my NixOS configuration. However, on a ne
     options.swarselsystems.server.paperless = lib.mkEnableOption "enable paperless on server";
     options.swarselsystems.server.transmission = lib.mkEnableOption "enable transmission and friends on server";
     options.swarselsystems.server.syncthing = lib.mkEnableOption "enable syncthing on server";
+    options.swarselsystems.server.restic = lib.mkEnableOption "enable restic backups on server";
     options.swarselsystems.server.monitoring = lib.mkEnableOption "enable monitoring on server";
   }
 #+end_src
@@ -5390,6 +5391,7 @@ Also, the system state version is set here. No need to touch it.
       ./paperless.nix
       ./transmission.nix
       ./syncthing.nix
+      ./restic.nix
       ./monitoring.nix
     ];
 
@@ -6571,6 +6573,18 @@ Also, the system state version is set here. No need to touch it.
   }
 #+end_src
 
+**** restic
+
+#+begin_src nix :tangle profiles/server/common/restic.nix
+  { pkgs, lib, config, ... }:
+  {
+    config = lib.mkIf config.swarselsystems.server.restic {
+
+      # TODO
+
+  }
+#+end_src
+
 **** monitoring
 
 #+begin_src nix :tangle profiles/server/common/monitoring.nix
diff --git a/modules/nixos/setup.nix b/modules/nixos/setup.nix
index ea5c909..8cb322f 100644
--- a/modules/nixos/setup.nix
+++ b/modules/nixos/setup.nix
@@ -21,5 +21,6 @@ in
   options.swarselsystems.server.paperless = lib.mkEnableOption "enable paperless on server";
   options.swarselsystems.server.transmission = lib.mkEnableOption "enable transmission and friends on server";
   options.swarselsystems.server.syncthing = lib.mkEnableOption "enable syncthing on server";
+  options.swarselsystems.server.restic = lib.mkEnableOption "enable restic backups on server";
   options.swarselsystems.server.monitoring = lib.mkEnableOption "enable monitoring on server";
 }
diff --git a/profiles/server/common/default.nix b/profiles/server/common/default.nix
index 8278e67..1733ab3 100644
--- a/profiles/server/common/default.nix
+++ b/profiles/server/common/default.nix
@@ -24,6 +24,7 @@
     ./paperless.nix
     ./transmission.nix
     ./syncthing.nix
+    ./restic.nix
     ./monitoring.nix
   ];
 
diff --git a/profiles/server/common/restic.nix b/profiles/server/common/restic.nix
new file mode 100644
index 0000000..e891c02
--- /dev/null
+++ b/profiles/server/common/restic.nix
@@ -0,0 +1,7 @@
+{ pkgs, lib, config, ... }:
+{
+  config = lib.mkIf config.swarselsystems.server.restic {
+
+    # TODO
+
+  }
diff --git a/secrets/general/secrets.yaml b/secrets/general/secrets.yaml
index 6bcffe0..9bdb063 100644
--- a/secrets/general/secrets.yaml
+++ b/secrets/general/secrets.yaml
@@ -13,8 +13,8 @@ edupass: ENC[AES256_GCM,data:13w+Gk+qdymEYxg=,iv:YlmNWvhMoP5040dxQm/5FixLwtmbLkU
 handyhotspot: ENC[AES256_GCM,data:D0ssFJ9kCBY=,iv:B1iCgDRpkTuVYtr4FtCvHTQTqVN1hpAkaNZrPdlzPMw=,tag:7LGegMEfwKLm8FJtzhbQ3Q==,type:str]
 vpnuser: ENC[AES256_GCM,data:ecsoOsubEkY=,iv:9tAKHXIAqe7rb8qp0VC3uQoTKJBZVoslftHYJv/t9PI=,tag:bKUGS4tPREhrYTMAIu5P2w==,type:str]
 vpnpass: ENC[AES256_GCM,data:h/dCaR9QPgS20w==,iv:2MoKiVMr2vYoPMV5xHm1OBlrqoFY2b5/jLv+5K87RyM=,tag:apjl3IjW/PH6BN4CmKpASA==,type:str]
-wireguardpriv: ENC[AES256_GCM,data:ZzC13qwHDfBcY5VxiC/Y8FJKdpPVkSAaAKPXKQdgSGUbNa+NA2IBhTWxJD4=,iv:Tv35O5MZIo1sQyLsdOVUi8SIQ9dewO3NsWvOmIUf2wI=,tag:DrQpFGD3+IvlOqxyWueP1Q==,type:str]
-wireguardpub: ENC[AES256_GCM,data:HeONQJ1Znwm5BtEnzROrEHcO1zskUsJxBq7X+JfzKM3ZgZquY0KHAysKD78=,iv:WcFL2GOjnmCrT52P+GdfJ1vzw2WcHlCTB8KPWqkHsxU=,tag:jnqRZeZFi+xWeXsd0R8WgA==,type:str]
+wireguardpriv: ENC[AES256_GCM,data:rY4k+Dy8qug6XXzTRZQFgAVrv4H27CndfUoup7Bprs0eXOwNeP5LOy17Flw=,iv:tT0SMBP5ldS/y70bvPixatEZ4HOw9JHXUVm1relOOBo=,tag:S1+49H+I0vY/aRnm3Srf6Q==,type:str]
+wireguardpub: ENC[AES256_GCM,data:fZDkZKXjpk3sXsNHJUyrmxsU2QO0kF35bqiNZcm+s9uuSvy/g4DtDtZUCM4=,iv:URbkDw6yYQ+eHkV73NkLdQ85xfNIVztv3R3Qi6W/zBY=,tag:XG8alTNnpbdJ2zu4ZzzxKQ==,type:str]
 wireguardendpoint: ENC[AES256_GCM,data:R65L/HkraRbb630YwOOuS4SoYc60,iv:M1Z8zWbWGkGrtZnPuTMXz4MznBu6bfpZP0bY7S86aHc=,tag:D8noDszpaQq5eigkCD9LKA==,type:str]
 github_notif: ENC[AES256_GCM,data:bkJh1Rta3IM51NjZm+UoOaHThib7WSpW+ZxZSNazbW2WvhhM0yB0YQ==,iv:/Z4T+kiEic4iWwvAW3QjzE67uZ2LpgFCxOHAIaunKHs=,tag:Hk1LMS07UE8coTL4BS6a+A==,type:str]
 stashuser: ENC[AES256_GCM,data:+fqMk2dL3g==,iv:4AVP46giHZWhzmyUhlbFdv9B8CYsa0GCDYKcoQZYo18=,tag:tJF0NaKtgEhvYz4LXtEulA==,type:str]
@@ -83,8 +83,8 @@ sops:
             a3VncGhOYkdZY1NtZlI0bllkQ1d0aVUKkkI0QF0NMAT1eZeddlRxQstEodH8thuv
             QaXjRtUnzoAsLife63EDLsUN71XGlQzY5Gv/Ovi46YqF/CHN9QplGQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-02T20:08:16Z"
-    mac: ENC[AES256_GCM,data:61rYilraCRY4Xxy/Kb7zImU5VVMG3BfVSYKI7QqnsFqr3QGNw+aoWvfOnkY0hIGj8ZzKaWcz0UdojseiqgJPTi2FgQg768UM9Ndt85eXUSbSUDdXJdNTzxzy/SG+Zhu1PlfboTGWjPpflegcudWQmAPhkLuKlnrRKWzqJNP6q1A=,iv:pmipb06EYu24OgC8uLMqNZ5x/GoeC5AkJtUPt4z6pLE=,tag:bCdxnVU45JbdJJzC6NsJtg==,type:str]
+    lastmodified: "2024-10-19T22:44:11Z"
+    mac: ENC[AES256_GCM,data:WkszgL1GEtg4x8mepLPiUcWukbxbbV2GX74ie0GPGpKN9J28XXrkxG8RhHSaWhAJkW3OQwchh+ZzUpIpAceJTfP/SpmjC87Rt53GjxmJnO4JmarVnMZSFG1aYVT+AWxCCMvScCZRM3MFY1f8I7r6G6m5DCVtba+3ypKj/+AgDJc=,iv:1ZtoDaFPBQT8iInL5zmBmoLTavqwP/IF/plcDvwv44M=,tag:A0W0261XwBip88JRMW24dQ==,type:str]
     pgp:
         - created_at: "2024-09-25T07:33:58Z"
           enc: |-
@@ -118,4 +118,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 4BE7925262289B476DBBC17B76FD3810215AE097
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.1