diff --git a/docs/src/runbooks/set-up-a-new-host.md b/docs/src/runbooks/set-up-a-new-host.md
index c5e2f467..7b0a37ef 100644
--- a/docs/src/runbooks/set-up-a-new-host.md
+++ b/docs/src/runbooks/set-up-a-new-host.md
@@ -153,18 +153,16 @@ nix run .#secrets
 Then enable backups in the host configuration:
 
 ```nix
-nixfiles.backups.enable = true;
-nixfiles.backups.environmentFile = config.sops.secrets."nixfiles/backups/env".path;
-sops.secrets."nixfiles/backups/env" = { };
+nixfiles.restic-backups.enable = true;
+nixfiles.restic-backups.environmentFile = config.sops.secrets."nixfiles/restic-backups/env".path;
+sops.secrets."nixfiles/restic-backups/env" = { };
 ```
 
 Most services define their own backup scripts.  For any other needs, write a
-custom script:
+custom backup job:
 
 ```nix
-nixfiles.backups.scripts.<name> = ''
-  <script which copies files to backup to the current working directory>
-'';
+nixfiles.restic-backups.backups.<name> = { ... };
 ```
 
 
diff --git a/flake.nix b/flake.nix
index 44ef4593..21255717 100644
--- a/flake.nix
+++ b/flake.nix
@@ -70,7 +70,7 @@
         in
         {
           backups = mkApp "backups" ''
-            PATH=${with pkgs; lib.makeBinPath [ duplicity sops nettools ]}
+            PATH=${with pkgs; lib.makeBinPath [ restic sops nettools ]}
 
             ${pkgs.lib.fileContents ./scripts/backups.sh}
           '';
@@ -111,9 +111,9 @@
                   ./shared/bookdb/options.nix
                   ./shared/minecraft/options.nix
                   ./shared/erase-your-darlings/options.nix
-                  ./shared/backups/options.nix
                   ./shared/foundryvtt/options.nix
                   ./shared/finder/options.nix
+                  ./shared/restic-backups/options.nix
                 ];
               };
               optionsDoc = pkgs.nixosOptionsDoc {
diff --git a/hosts/carcosa/configuration.nix b/hosts/carcosa/configuration.nix
index 2fc45230..2846c83d 100644
--- a/hosts/carcosa/configuration.nix
+++ b/hosts/carcosa/configuration.nix
@@ -64,18 +64,33 @@ in
   ## Backups
   ###############################################################################
 
-  nixfiles.backups.enable = true;
-  nixfiles.backups.environmentFile = config.sops.secrets."nixfiles/backups/env".path;
-  nixfiles.backups.scripts.syncthing = "cp -a /home/barrucadu/s .";
-  # TODO: this will break when I have >100 github repos
-  nixfiles.backups.scripts.git = ''
-    curl -u "barrucadu:''${GITHUB_TOKEN}" 'https://api.github.com/user/repos?type=owner&per_page=100' 2>/dev/null | \
-      jq -r '.[].ssh_url' | \
-      while read url; do
-        git clone --bare "$url"
-      done
-  '';
-  sops.secrets."nixfiles/backups/env" = { };
+  nixfiles.restic-backups.enable = true;
+  nixfiles.restic-backups.environmentFile = config.sops.secrets."nixfiles/restic-backups/env".path;
+  nixfiles.restic-backups.checkRepositoryAt = "Wed, 12:00";
+  nixfiles.restic-backups.backups.github = {
+    # TODO: this will break when I have >100 github repos
+    # TODO: use a backup-specific SSH key?
+    prepareCommand = ''
+      ${pkgs.coreutils}/bin/mkdir repositories
+      cd repositories
+
+      ${pkgs.curl}/bin/curl -u "barrucadu:''${GITHUB_TOKEN}" 'https://api.github.com/user/repos?type=owner&per_page=100' 2>/dev/null | \
+        ${pkgs.jq}/bin/jq -r '.[].ssh_url' | \
+        while read url; do
+          env GIT_SSH_COMMAND="${pkgs.openssh}/bin/ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i /home/barrucadu/.ssh/id_ed25519" \
+            ${pkgs.git}/bin/git clone --bare "$url"
+        done
+    '';
+    paths = [
+      "repositories"
+    ];
+  };
+  nixfiles.restic-backups.backups.syncthing = {
+    paths = [
+      "/home/barrucadu/s"
+    ];
+  };
+  sops.secrets."nixfiles/restic-backups/env" = { };
 
 
   ###############################################################################
diff --git a/hosts/carcosa/secrets.yaml b/hosts/carcosa/secrets.yaml
index 70af5b1f..ff460b9b 100644
--- a/hosts/carcosa/secrets.yaml
+++ b/hosts/carcosa/secrets.yaml
@@ -1,14 +1,14 @@
 users:
     barrucadu: ENC[AES256_GCM,data:5mAoxmMEn4zOhwDHS4cal7b0fPZb7SshS3QmfrBgLKQMJfExiRdnWvwnqTvLY/ObRTYqeWrcik+GVyeFF4gkMm8FxcR7U5ExIXBbtg5uDQgcvQYNlWEfJWEjVYrfKCoIxCAhUDf+2oNr,iv:YEpqdGz/DNdjxNmIrVgahEoH7BNYnqBEHV6L7UrV2aI=,tag:4teSWBW+SJ06KCoTMwjN6g==,type:str]
 nixfiles:
-    backups:
-        env: ENC[AES256_GCM,data:U3PwGmQkEMHEYE89g5LlzVAjftG4b7WIvvfNDOw9OUpKjmZX23SlfvDYwZhAABexAQyG1Izi+wdBnnLbD/as7sTgGhQk7K+mK2JcVnekCx8tBggvDrsu+rJqegFYj/fmGrVI4DfcD8d6V7/sc5/oIiERM3xp78ZaNgwUC7+FWqljcNcEGD36+GXeSXR+4xjDclC9iZKYYOM1Ef4FHj21YrUA3FYXEMmvQO87PLYQ745+RxVgOKy62hcjSpgf201i55WCBWVpS4GrY6DI2Vg/QoEp303zIymhTsxu+VS7hHGctwZY/9jEzQn6TnDI3SEsNxRPaorSLvYgHXnYWiNjeYndUJbb9A/9+Q3EHgRXkkKsKyjobvV+AIU5O4wv9wRGF61GjUjd3f9AmYa/1M/QZWsJOjoYnuG5925M3V3lK1Df6A7lhNEbX8kPtp+zXsr1ubR1Vtg5DbSKdLSjBm+TAOKq0VmwZ7FN+fvAX8CZV7NjurlZ7Q7Os75aXlDAxyMYCsiE5mKcr0vmEmXAKEyVicjDcNeVVOBsv5uaeHiTPmi2Eiq7itVtgV5PLYQ3QoISJwumSJ9i3IaI9P+fTLEzAeFC9ykR8uWpV7a3wXqND0uQ2FNbgVeyuZ492adaVH3w3eHWSHfB0xQCpeUD4SuyC71Cmn+4NoU3uVO9L1w7R5Nl2rE0DbcxDbLXTHwmJegIaHHN4cnxCZBU8Ec7moQMLAZ24NydTF2U5fBjYBCz3itoVfwx5gEuiSnaPVxZ81zZ2fZSB5gcKtFRjAYnZKfwkBcnHpxI6FWkHHvt/fgPkjhiNKkjVEzHicD5g7HLwalwNkUy+hBOyBPhNrOlX3cUvjdgoROCrs1xuWWR2RdZYnE1HzDDLVja8TmjEOIqzRW+wABws3vGQK/3RCPZ1aQmb5c7LF3vTJPeyZDoRXghs7Xy6SCpEJRnnMqWaPkKh3yV6BWda8dn9kFv4HuOZYr1zo2i/2Efja8p3uHpbcfMrQLfbs9u72eM0efB92LsVxYiDMfZdQUdEdo=,iv:RSK2SK73RM//TUw2PNRF9UXmNCE+RkEWdrPGdMGCkw8=,tag:j6R8qE0+pO7CxTxcVmRs5Q==,type:str]
     concourse:
         env: ENC[AES256_GCM,data:PmopaM/Gn8sHW+rOSQM2scZ+KBjlhsgiAGO0nLtcflZE6gBq81lxnK2Sq/w9YUjfD2OdTLAMGPfSyYv2oZNQxBeXYbr8UY+FeY6qorFT9c0H7pwR0vYqmhlKc+3X4EQuqm+QzBT7SXUCdoSKlM6Q0nS0pvQUU67iyTk6NhPCagVRub4vq0oYMCfeiGWCHKqILzd4JUi/Ijk+W2BTlLkT3YQZPZugz7cZcZybUS60hkCRAE91Up9iHmcDIPwvi8gwxkssnby2mzK9u6wEtUtSSh+628KkQsXHoN4XSUuhiwJDO/3513c4IEQuZIV72v5t6sCRkI3UkuQ4GH8yrBM4XP0FGADAOVQObwO+a6xry8y9L2U=,iv:YQ10+rk4rQtZlRvG7cr2SiTMRFI8YzH2rcO+c746mkw=,tag:urQeoA15qNWiDDHmf+81Kw==,type:str]
     firewall:
         ip_blocklist: ENC[AES256_GCM,data:WgDvhHX/CTbbBRVJVr5v4nLQP5sxI8A5KomrSoXble7eUlAZeXqnhw4UT/EugIKaudZzVWovHe30G1U9W86X1/dgAj1S8hD0mA0TH6Qul3RfmQdqnZIdJXfDBLH1mF4OXaox6A==,iv:PVKlgOErmZGAC2tf5mW7d3S7vvMRclrpr+aDd/xJ1WI=,tag:EeXzbX9BELSCeBcxifbHPQ==,type:str]
     pleroma:
         exc: ENC[AES256_GCM,data:ZyA/hBlQs8S56oy7J1f9u36nYBFwWH4Ehq5VbjYDAxcThgP5x09qqt0G8URuLSbBZYuWOOrCjSF1gkt9oLKBPYw2bKxf0yg69GL8xkBtZuJU9NNLXcVswG8HZFWG6Rwa6F65GIHQWdZLwkA8ef5RcYD77FFV3YG4qCIxyH5efyVd0xTO7ukuapGC23mRPd1auUNHlTt0/mac8a+wjBmG175j2MFnzDj7e4Z2ynqgSVrkM/DKm4/xiED5J1vNpPQAkNWouzELo70x7XsLk8/WIVXtsLI24OEo+BE+9/pf9T+RObftUDMnSejhLFadKTqa7QHh6RJgV1lkJL+ZvDm5XY962BzJrMw/3N+h30qD+QCmkuyLqIbTAP7nFeJ7iumU1Bgv6ojLPtrxLX4TE/lP9Mv9JG1/w+4oMAeSv5t/uFw4pI4P07c5cGRwE9VHIT57roJ6beKRD/3p7FJxeEFOu5/O9EoxHTCjXWXMrdEM6bYfMMQZYBM7p8Ve0bE=,iv:4njRxb8LiKdW5YgQEP2Esvh8/yKHpiCxTiL/n6b+c5M=,tag:lPqLddPhY0r0rnuxtwvwIg==,type:str]
+    restic-backups:
+        env: ENC[AES256_GCM,data:Uls7HrNxFyoMZf3u4zNSk/F3XIYE1mQotcCvnNggvbOqA9RVK9FQpIfqJms8WtKZl6ol15rHW+au73QldJ9TE2Km7EJmCSa87AmRQ1Azt0lrJtn+v9l9rFqnu82WSD2awv8geB82OPQ0/w2x9W4qHPXw3teYx9p9Kiz/C1NVw0Z9TlsChKHsVpR6FVdyB8FY8zZG0Z1iuzDHMr6q9QsI8pMn5DkCruYhcg8R6GR73naWQb0nHxx3oFfNR3KtPHQn8diJZsv0+Hh2IWbHyPRlJOs+WYJtVc7LbqjB1jPrTozqteijclVSHAoB1RTQ7gVe9TiYdQIhOJswo89xH4l7U/D9wYH7tGRlrrKz8F8iUQR02G7gADftmwI9kekhCjGDgSudYrRJ//UCJKTn6bSsEpW0Eg9knozFCUOhc5RREmX7JyKA,iv:BqaFmxO+HRZzQchypReabxer0XwHW9KSsA1lfhWmdIM=,tag:3rJjQm+kLRMscygvkLHTcw==,type:str]
     umami:
         env: ENC[AES256_GCM,data:FDH0WI/eUDeuylLoL0xNgLawV6ROVTyK3iW25a7z7wesEBPrH1ffs/mQlBiCVG4a0KsC6QCcsCyJxXA2kFrFNm2ktVDouJd4ECuN,iv:SYzk1s24nFgiKswkXiTLSPIBW6v0JoeN6J5o89zzZuQ=,tag:LAwSKw+9GaqHWo9A9gQjsw==,type:str]
 services:
@@ -45,8 +45,8 @@ sops:
             dTQwclBRU3JmQ2hBOFVlaVIxZHN4cVEKvVR1bSH4yo2Td8YGNI2hmflT0M3hcYu8
             qyYoWd5MFP9VBYKxrF8W2naQSY6Ax4IiVuNbKDDLFooTC93V+oxNDA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-04-01T13:59:46Z"
-    mac: ENC[AES256_GCM,data:TmeJV5P+bAQ3IfnIWrEGlCQ1VuBv6dDTxT5l6v++cvTSAY+ed2kE0nfc+D159EvX2KkcUSPcApZyQPCk4EuREQwdd6ugb1SAowZSe3I62uZRegZhdAEVfOip1e9zFXyPSNFLoCo/q7xaBI8anLxpEjIzLhyn3WyR/ecs6BVS67w=,iv:2jNyjkXTDcc5qHXFjHODKZNOmoj8K3BJbhUjZwjOKVg=,tag:t+66U+bgYFY0H+xFXGbaJg==,type:str]
+    lastmodified: "2024-01-26T23:48:26Z"
+    mac: ENC[AES256_GCM,data:Ay1JpYoj+XRBPoPwuy5QJ8jmbxfzyBKe0p1F/Twp/F4nMstPv65+W7D+KLOJg66ki2/3j2nuhJnhsypmG20bAHA+Yr3nRPwO/0NHNQCuTxLmjFI4TjTlqHfofUzjAajXHSThm2bCz4nuqSpI+UVL9VOTJl1OR05jhYclozrZacw=,iv:V3vVrISCkFaLP/67IAd1VLVNpHkzZwtni6ace5kTWIk=,tag:LUCeYK2M85u/aUl3cdBNpQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
diff --git a/hosts/nyarlathotep/configuration.nix b/hosts/nyarlathotep/configuration.nix
index ecdcfc8c..10a7df25 100644
--- a/hosts/nyarlathotep/configuration.nix
+++ b/hosts/nyarlathotep/configuration.nix
@@ -63,13 +63,26 @@ in
   ## Backups
   ###############################################################################
 
-  nixfiles.backups.enable = true;
-  nixfiles.backups.environmentFile = config.sops.secrets."nixfiles/backups/env".path;
-  nixfiles.backups.pythonScripts = {
-    share = fileContents ./jobs/backup-share.py;
-    youtube = fileContents ./jobs/backup-youtube.py;
+  nixfiles.restic-backups.enable = true;
+  nixfiles.restic-backups.environmentFile = config.sops.secrets."nixfiles/restic-backups/env".path;
+  nixfiles.restic-backups.backups.torrents = {
+    prepareCommand = ''
+      ${pkgs.python3}/bin/python3 ${./jobs/restic-prepare--hardlink-torrent-files.py} > hardlink-torrent-files.sh
+    '';
+    paths = [
+      "hardlink-torrent-files.sh"
+      "/mnt/nas/torrents/watch"
+    ];
   };
-  sops.secrets."nixfiles/backups/env" = { };
+  nixfiles.restic-backups.backups.youtube = {
+    prepareCommand = ''
+      ${pkgs.python3}/bin/python3 ${./jobs/restic-prepare--fetch-youtube.py} > fetch-youtube.sh
+    '';
+    paths = [
+      "fetch-youtube.sh"
+    ];
+  };
+  sops.secrets."nixfiles/restic-backups/env" = { };
 
 
   ###############################################################################
diff --git a/hosts/nyarlathotep/jobs/backup-share.py b/hosts/nyarlathotep/jobs/backup-share.py
deleted file mode 100644
index 3e002dcc..00000000
--- a/hosts/nyarlathotep/jobs/backup-share.py
+++ /dev/null
@@ -1,149 +0,0 @@
-#!/usr/bin/env python3
-
-"""MAGICAL BACKUP SCRIPT!
-
-Copies directory structure, hardlink mapping, and un-hardlinked files.
-As I only use hardlinks for torrents, this makes sense.
-"""
-
-import os
-import shlex
-import shutil
-import sys
-
-# Directory to generate the backup in.
-TARGET = os.getcwd()
-
-# Directories to back up.
-BACKUP_DIRS = ["/mnt/nas"]
-
-# Directories to mkdir, and then skip all children.  Do not end with a
-# trailing "/".
-SKIP_DIRS = ["/mnt/nas/misc", "/mnt/nas/music"]
-
-# Files to skip.
-SKIP_FILES = []
-
-# Where rtorrent downloads its files to.  End with a trailing "/".
-TORRENT_FILES_DIR = "/mnt/nas/torrents/files/"
-
-
-def sizeof(num, suffix="B"):
-    """Turn a number of bytes into a human-friendly filesize."""
-
-    for unit in ["", "Ki", "Mi", "Gi", "Ti", "Pi", "Ei", "Zi"]:
-        if abs(num) < 1024.0:
-            return "%3.1f%s%s" % (num, unit, suffix)
-        num /= 1024.0
-    return "%.1f%s%s" % (num, "Yi", suffix)
-
-
-def traverse(base, dirs, matches, stats, skip_dirs=[], skip_files=[]):
-    """Traverse a directory hierarchy, recording directory names and
-    file/inode mappings.
-
-    Does not return anything, mutates 'dirs' (a list), 'matches' (a
-    dict), and 'stats' (a dict).
-    """
-
-    for root, _, files in os.walk(base):
-        skip = False
-        for d in skip_dirs:
-            skip = skip or f"{d}/" in root
-        if skip:
-            continue
-
-        dirs.append(root)
-
-        if root in skip_dirs:
-            continue
-
-        for fname in files:
-            path = f"{root}/{fname}"
-
-            if path in skip_files:
-                continue
-
-            try:
-                info = os.stat(path)
-                k = (info.st_dev, info.st_ino)
-                sofar = matches.get(k, set())
-                sofar.add(path)
-                matches[k] = sofar
-                stats[path] = info
-            except FileNotFoundError:
-                print(f"File {path} disappeared while being inspected")
-
-
-def guesstimate_needed_space(matches, stats, target_dev=None):
-    """Estimate how much free space is needed for the backup.
-
-    Space to copy everything which can't be hardlinked * 4/3 for
-    wiggle room.
-    """
-
-    copy_size = 0
-    total_size = 0
-    for match in matches.values():
-        if len(match) == 1:
-            path = match.copy().pop()
-            if TORRENT_FILES_DIR in path:
-                continue
-            total_size += stats[path].st_size
-            if not stats[path].st_dev == target_dev:
-                copy_size += stats[path].st_size
-    return total_size, int(copy_size * 4 / 3)
-
-
-# traverse directories to find files
-dirs = []
-matches = {}
-stats = {}
-for to_backup in BACKUP_DIRS:
-    traverse(
-        to_backup, dirs, matches, stats, skip_dirs=SKIP_DIRS, skip_files=SKIP_FILES
-    )
-
-# check for free space
-target_dev = os.stat(TARGET).st_dev
-statvfs = os.statvfs(TARGET)
-free_size = statvfs.f_frsize * statvfs.f_bavail
-total_size, needed_size = guesstimate_needed_space(matches, stats, target_dev)
-if free_size < needed_size:
-    print(
-        f"Not enough free space on device (needed {sizeof(needed_size)}, got {sizeof(free_size)}), aborting..."
-    )
-    sys.exit(2)
-
-# create directory hierarchy
-for root in dirs:
-    os.makedirs(f"{TARGET}/{root}", exist_ok=True)
-
-# copy files & generate hardlink script
-progress = 0
-with open(f"{TARGET}/make-hardlinks.sh", "w") as f:
-    print("#!/bin/sh", file=f)
-    print("", file=f)
-
-    for match in matches.values():
-        percentage = progress / total_size * 100
-        if len(match) == 1:
-            path = match.pop()
-            # don't copy across unlinked torrent files
-            if TORRENT_FILES_DIR in path:
-                continue
-            copy = os.link if stats[path].st_dev == target_dev else shutil.copy2
-            print(f"[{percentage:8.4f}%] Copying {path}")
-            copy(path, f"{TARGET}/{path}")
-            progress += stats[path].st_size
-        else:
-            # if one of the files is in TORRENT_FILES_DIR, we want to
-            # link to that; otherwise it doesn't matter.
-            for target in match:
-                if TORRENT_FILES_DIR in target:
-                    break
-            for link_name in match:
-                if target == link_name:
-                    continue
-                print(f"[{percentage:8.4f}%] Linking {link_name}")
-                print(f"ln {shlex.quote(target)} {shlex.quote(link_name)}", file=f)
diff --git a/hosts/nyarlathotep/jobs/backup-youtube.py b/hosts/nyarlathotep/jobs/backup-youtube.py
deleted file mode 100644
index f5447feb..00000000
--- a/hosts/nyarlathotep/jobs/backup-youtube.py
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env python3
-
-"""Youtube "backup" script - generates a script to download videos.
-"""
-
-import os
-import shlex
-
-SOURCE_DIR = "/mnt/nas/misc/youtube"
-VIDEO_URL = "https://www.youtube.com/watch?v="
-
-with open("download-videos.sh", "w") as f:
-    print("#!/bin/sh", file=f)
-    print("", file=f)
-
-    for dirpath, dirnames, filenames in os.walk(SOURCE_DIR, topdown=True):
-        for dirname in dirnames:
-            print(f"mkdir {shlex.quote(os.path.join(dirpath, dirname))}", file=f)
-        for filename in filenames:
-            # filenames are of the form "title [id].ext"
-            name_pattern = filename.split("[")[-2] + "[%(id)s].%(ext)s"
-            url = VIDEO_URL + filename.split("[")[-1].split("]")[0]
-            print(
-                f"yt-dlp -P {shlex.quote(dirpath)} -o {shlex.quote(name_pattern)} {shlex.quote(url)}",
-                file=f,
-            )
diff --git a/hosts/nyarlathotep/jobs/restic-prepare--fetch-youtube.py b/hosts/nyarlathotep/jobs/restic-prepare--fetch-youtube.py
new file mode 100644
index 00000000..5d28a6ff
--- /dev/null
+++ b/hosts/nyarlathotep/jobs/restic-prepare--fetch-youtube.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+
+"""Youtube "backup" script - generates a script to download videos.
+"""
+
+import os
+import shlex
+
+SOURCE_DIR = "/mnt/nas/misc/youtube"
+VIDEO_URL = "https://www.youtube.com/watch?v="
+
+print("#!/bin/sh")
+print("")
+
+for dirpath, dirnames, filenames in os.walk(SOURCE_DIR, topdown=True):
+    for dirname in dirnames:
+        print(f"mkdir {shlex.quote(os.path.join(dirpath, dirname))}")
+    for filename in filenames:
+        # filenames are of the form "title [id].ext"
+        name_pattern = filename.split("[")[-2] + "[%(id)s].%(ext)s"
+        url = VIDEO_URL + filename.split("[")[-1].split("]")[0]
+        print(
+            f"yt-dlp -P {shlex.quote(dirpath)} -o {shlex.quote(name_pattern)} {shlex.quote(url)}",
+        )
diff --git a/hosts/nyarlathotep/jobs/restic-prepare--hardlink-torrent-files.py b/hosts/nyarlathotep/jobs/restic-prepare--hardlink-torrent-files.py
new file mode 100644
index 00000000..4a8f95ce
--- /dev/null
+++ b/hosts/nyarlathotep/jobs/restic-prepare--hardlink-torrent-files.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+
+"""Torrent "backup" script - generates a script to create the directory
+hierarchy and hardlink files.
+"""
+
+import os
+import shlex
+import sys
+
+# Directories to link
+MEDIA_DIRS = ["/mnt/nas/anime", "/mnt/nas/movies", "/mnt/nas/tv"]
+
+# Where rtorrent downloads its files to
+TORRENT_FILES_DIR = "/mnt/nas/torrents/files"
+
+# Where .torrent files are stored
+TORRENT_WATCH_DIR = "/mnt/nas/torrents/watch"
+
+# Only list unlinked files, don't generate a linking script
+CHECK_ONLY = "--check" in sys.argv
+
+
+def print_cmd(cmd):
+    """Print a command, if not in checking mode."""
+
+    if not CHECK_ONLY:
+        print(cmd)
+
+
+def file_ref(fpath):
+    """Return a unique reference to the file, consistent across hardlinks."""
+
+    info = os.stat(fpath)
+    return (info.st_dev, info.st_ino)
+
+
+def find_inodes(base):
+    """Return the set of inodes under the given base directory."""
+
+    inodes = dict()
+    for root, _, files in os.walk(base):
+        for fname in files:
+            fpath = os.path.join(root, fname)
+            inodes[file_ref(fpath)] = fpath
+    return inodes
+
+
+def traverse(base, inodes):
+    """Print out `mkdir` and `ln` commands to rebuild the directory / file
+    hierarchy under `base`, linking files to `inodes`.
+    """
+
+    for root, _, files in os.walk(base):
+        print_cmd(f"mkdir {shlex.quote(root)}")
+        for fname in files:
+            fpath = os.path.join(root, fname)
+            ref = file_ref(fpath)
+            if ref in inodes:
+                source_file = inodes[ref]
+                print_cmd(f"ln {shlex.quote(source_file)} {shlex.quote(fpath)}")
+            elif os.path.splitext(fpath)[-1] == ".torrent":
+                source_file = os.path.join(TORRENT_WATCH_DIR, fname)
+                print_cmd(f"cp {shlex.quote(source_file)} {shlex.quote(fpath)}")
+            else:
+                print(f"Unknown path {fpath}", file=sys.stderr)
+
+
+inodes = find_inodes(TORRENT_FILES_DIR)
+for media_dir in MEDIA_DIRS:
+    traverse(media_dir, inodes)
diff --git a/hosts/nyarlathotep/secrets.yaml b/hosts/nyarlathotep/secrets.yaml
index fe4fade7..4f6d65e0 100644
--- a/hosts/nyarlathotep/secrets.yaml
+++ b/hosts/nyarlathotep/secrets.yaml
@@ -4,10 +4,10 @@ users:
     remote_sync:
         ssh_private_key: ENC[AES256_GCM,data:lOfo8ALZTCq7GVEZ+2KCDch+mOkOrSm5oqJKUNP+JVqfxA3r2GV8071ESFme8oTmsLIl/u5W9UxK6GMobM5M4ynZUTr1H3/yLRMNrbymTqIrKeGejaIy4hZRbF4Pv4NgtRTbnBfP7HHHnhykARuROmmtLQVITrAi4j9BJ7smyzOd8rdeyOsHBioOd784DLUGXQaGAmEvBRGuZ/pq3hEV0kQof5I94V82A7zWjZpD4yO76e+LYCA0Eu2FxM88P5jkiTPWLxFciY0z++2QvPguuYeXeAFkDc7yR2hiWFWT+rtfZSGsBL+Czse9PZbatugHn59ZPEzvUlv+FTnx5Vc1o9fQYGWCJGerZY2Sg6AtPglEdrmeTtEeELGVmnK/i5etlRaOER4fGSIIoIQ/xAor/GK0laoMQtU/MDLcuvw8BtD91/yTwFYbrghe8BEbnO36OUFQFh4OIWo8pHnkfbPZtJF+fRjXiO5yEdZpx29pMrqkhWqvEeujGurLZvTcQLX2iJ0utmQ3zv2/d8c+mzNHPNxUvHAEkp3kUjyktq0aylyjTdw=,iv:rxxAph3k6JEFJaq1LbWfIj6ah1E9r6locEBDghf/7gE=,tag:oEp4/ILyn5YfEDgC7eMhiw==,type:str]
 nixfiles:
-    backups:
-        env: ENC[AES256_GCM,data:i+kty6qhXnRp/h+LnoTLpjqoUcJ64qyiokuCdH8abi3jOSMV1ITCSo3qXRAsQzL1BcZdTLwqwqtrh+mOonbu1UYfpiaKRydggrJMxkcSwENZ0MT2qlAnaEyhHbCDI7N2l5kG3meusYRG8ytQfiySHl21QF6ZXFik5XkkTbNTHkTVHpW8gM/DslRBv0/ZmfyGEcjKVS71RMX9NXVwj9hgeqqx1pCXP9/vI0z+g6j8wlp1hUnHwy79eK8CrGMeJ4iS5/rHg5c4nigwZB038hbq0vsP5lKol0//ma3I7Ir3B7Fp/2rO641kcwOzvMZMgTPfVRTh5zMoIO3rwouhg9G4pX2YDfdz4qkwqAhkReGQhtz2N7riqZp+rxPcZmwH+sTmhR4LKH8+lpnPcVVgz+uuI4NO66xbA1DtSAAhSPZGxD5lt2ZVGTwkt/6Mr3Be+MSo00intitcVNYP7gykZJLUyjvRwe8lT/9IDBiHFqRapSZsEavwcgOj7nmLdM40CUtHThbcRu/WU0Jt+8R4IDlSHdDv2d3nqpAZT/TozWxePLemRNsU2yB4qB1rgEwJnJe7E747A8t3A7c04BuIgEJMLQE5KaiB+mOGHG6emzdMXpEorrEyKhieGQAR81ltSZyFwrt1nOB+9bch53+1WyRXO1NemgqX/ujLgELbZ5VySBlxJy4qodK59ZkMJwtCdbb8EujfqWSTV4jMAx4EK2wKS41QLjjo+rskEp9F+Ox4Wdkv68u+FECmKw1hOWfOqSzO8tADQ13PrY+0ZTOb0XFbeBkxYd8hxIntRWHoJhEF83at94ntG/gsY/ATeUzKdGBJKQNjzQc6mvJzVCMn3QmnF6FkZU8Q+HYVj5ofWAQwvwjhnZ2mKqbQNm/J0nmk4lC0DDv3tTyyjh24noJygc38yiCyNS7eXtYE61auZ1a4SCB+TR9e1QclogYy6QcMaOrHNw==,iv:GXQ60A7AYcxiCZzWVk7OYL90qPifFT0paHvKlFGHTp8=,tag:5cv0XJNeb77k0YJ9c5cO1w==,type:str]
     bookmarks:
         env: ENC[AES256_GCM,data:Hw+/ug7sKjD6BKScmlerAw+B3pO7zSA4moJ71u9FQdXdG+o/NNQVwWhMVzVna/Ib22+TsvsPLzQ=,iv:6jLNK0pFjt2B4kJHhwHgVLFBciUPuyANrBeS5dnI4HA=,tag:tFa/ClwFFfZJ151birgpnA==,type:str]
+    restic-backups:
+        env: ENC[AES256_GCM,data:K+JPrEyTiwClQ7z7p8IIv3CQZ2I2FMWKM7fZp2bGdahrezv5WihM1layoMXaZKK3sX4Mh1egaRUaDIW89+tvQFEN8zvekBOd7m2upmxVjsayCOLdV1wPSD/YZBPt15pZnNI8iIciaQWGSVZHvFn+V3H49PvXzQV4r0N1NQYiBPinCBVpcw6P9309CAPMVFmA0tCwPNUHp1JOJcDolhdmCIgPfTpDCeoZ8/1Ln9J+T4W5kZ6vrMXtRmTvD6ItAnRNsUx+07mAvTP2kosVAIgT1h8nC5Nt3rv3dCdOVaK6ILahSwCY0fnDq9mQU0ALADF8jGbi0xIfidQDdZp/7OaAbjhUiwTBkSoFu5KAfUk=,iv:MS5LRsfpKg5alaxpBuXiI0JWA5zFfLsMUPFoYLtzqoo=,tag:EItXOV+GgqbXRyYFmkuweg==,type:str]
 services:
     alertmanager:
         env: ENC[AES256_GCM,data:O3XHFKP9NRSfRuLOg0cF+g2knAYyAMoc1s+fJ3/eikOxGyqPlKehlJhjh+lfW5Em7VUjwLVZLjsR0Hq+zvx9oHFGiBX8wxWhYMajMjzE9yfyAghmiIX5LL1T9Wgz+TBS4IJw0uEU,iv:/LyaBKRMHcAn8wQTwj6ZQBR17pnNdIanHi4CWLSfENs=,tag:FVjC/MEci9B4hWA5Ev3+Yw==,type:str]
@@ -35,8 +35,8 @@ sops:
             UFVZQkpPSUY1YWZlRlFCbDNBcHhzVmcKzBqO5fMoaNerJw3ovWXCPLQM0cDfte03
             ZiXMnrIUfIf2AntjjnZKc84jsnubTyD2fQLGNVkAetmQ3PTb3OKXqQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-31T23:34:45Z"
-    mac: ENC[AES256_GCM,data:bA1lVHix0FBI9MnzVYqYkZAFa7tcIR/QH3c8Q2mrYpyT1Bhkw9GAIblT4h8JtfWrBUrqRXDnbtmJMZAfKnGNiTk+QWN0hmfOhzAS6WIve9MkdCeObzBdndOGi9d1dyQ0Yoq0JVhAJ/14ah+2/Kw+ABioGCRdNELUVVAkzZJrlv0=,iv:hSh7qok2HaFZJi4RvzoKLssI45EbJwn1Oe3t4zzI/YU=,tag:LzB7aRV7PIS6MInSn3Y1kg==,type:str]
+    lastmodified: "2024-01-26T23:48:16Z"
+    mac: ENC[AES256_GCM,data:Sj6PMYullYi16nqwqxRLvXrCGCfSIeABt2MBTwsw4xAIrutcH0f9DVg7RLq5VDMbOuUGnxQhmMK1hvrTn6ZPma4JlwROGmg+q7WG6KQaNLfMr0wlz/sKGkEgmZg83vk8VyOzJna+ymEBo3dWwXMBAbInOtClqovt8Fr9gucxiHU=,iv:roZkkE7HHydKCn5Q2R4FRBLUYdkzAaUA3E3ndaAl+wc=,tag:tAHHAWCtN4kGRYQPgcQ3OQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
diff --git a/scripts/backups.sh b/scripts/backups.sh
index ad605564..7dec8b94 100644
--- a/scripts/backups.sh
+++ b/scripts/backups.sh
@@ -1,37 +1,52 @@
 set -Ee
 
-COMMAND=${1:-status}
-TARGET=${2:-$(hostname)}
+export RESTIC_REPOSITORY="b2:barrucadu-backups-a19c48:nixfiles/restic"
+
+COMMAND=$1
+TARGET=$(hostname)
+
+if [[ -z "$COMMAND" ]]; then
+  COMMAND=snapshots
+else
+  shift
+fi
 
 if [[ ! -f "hosts/${TARGET}/secrets.yaml" ]]; then
   echo "unknown host '${TARGET}'"
   exit 1
 fi
 
-sops_env=$(sops -d --extract '["nixfiles"]["backups"]["env"]' "hosts/${TARGET}/secrets.yaml")
+sops_env=$(sops -d --extract '["nixfiles"]["restic-backups"]["env"]' "hosts/${TARGET}/secrets.yaml")
 # shellcheck disable=SC2163
 # shellcheck disable=SC2086
 export $sops_env
 
-if [[ "$COMMAND" == "status" ]]; then
-  duplicity                  \
-    --s3-european-buckets    \
-    --s3-use-multiprocessing \
-    --s3-use-new-style       \
-    --verbosity notice       \
-    collection-status        \
-    "boto3+s3://barrucadu-backups/${TARGET}"
-elif [[ "$COMMAND" == "restore" ]]; then
-  RESTORE_DIR="${RESTORE_DIR:-/tmp/backup-restore}"
-
-  duplicity                  \
-    --s3-european-buckets    \
-    --s3-use-multiprocessing \
-    --s3-use-new-style       \
-    --verbosity notice       \
-    restore                  \
-    "boto3+s3://barrucadu-backups/${TARGET}" "$RESTORE_DIR"
-else
-  echo "unknown command '$COMMAND'"
-  exit 1
-fi
+case "$COMMAND" in
+  check | snapshots)
+    restic "$COMMAND" "$@"
+    ;;
+
+  restore)
+    SNAPSHOT=$1
+    shift
+
+    if [[ -z "$SNAPSHOT" ]]; then
+      echo "usage: 'restore <snapshot> [<restore-dir>]'"
+      exit 1
+    fi
+
+    RESTORE_DIR=$1
+    if [[ -z "$RESTORE_DIR" ]]; then
+      RESTORE_DIR="/tmp/restic-restore-${SNAPSHOT}"
+    else
+      shift
+    fi
+
+    restic restore "$SNAPSHOT" --target "$RESTORE_DIR" "$@"
+    ;;
+
+  *)
+    echo "unknown command '$COMMAND'"
+    exit 1
+    ;;
+esac
diff --git a/shared/backups/default.nix b/shared/backups/default.nix
deleted file mode 100644
index 6fc91569..00000000
--- a/shared/backups/default.nix
+++ /dev/null
@@ -1,137 +0,0 @@
-# Manage regular incremental and full backups with [Duplicity][].
-#
-# Backups are encrypted and uploaded to the `barrucadu-backups` s3 bucket,
-# [defined in the ops repo][].
-#
-# Check the status of a backup collection with:
-#
-# ```bash
-# nix run .#backups                   # for the current host
-# nix run .#backups status            # for the current host
-# nix run .#backups status <hostname> # for another host
-# ```
-#
-# Restore a backup to `/tmp/backup-restore` with:
-#
-# ```bash
-# nix run .#backups restore            # for the current host
-# nix run .#backups restore <hostname> # for another host
-# ```
-#
-# Change the restore target by setting `$RESTORE_DIR`.
-#
-# **Alerts:**
-#
-# - A backup script terminates with an error.
-# - Uploading the backup to s3 fails.
-#
-# [Duplicity]: https://duplicity.gitlab.io/
-# [defined in the ops repo]: https://github.com/barrucadu/ops/blob/master/aws/backups.tf
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.nixfiles.backups;
-  hostname = config.networking.hostName;
-
-  chown = name: "${pkgs.coreutils}/bin/chown -R ${cfg.user}.${cfg.group} ./${name}/";
-
-  runScript = cmd: name: source: ''
-    echo "${name}"
-    mkdir "${name}"
-    pushd "${name}"
-    if ! time ${cmd} "${pkgs.writeText "${name}.backup-script" source}"; then
-      fail "Backup failed in ${name}"
-    fi
-    popd
-    /run/wrappers/bin/sudo ${chown name}
-  '';
-
-  script = pkgs.writeShellScript "backup.sh" ''
-    set -e
-
-    function fail(){
-      echo "Backup failed: $1"
-      aws sns publish --topic-arn "$TOPIC_ARN" --subject "Alert: ${hostname}" --message "$1"
-      exit 1
-    }
-
-    BACKUP_TYPE=$1
-    if [[ -z "$BACKUP_TYPE" ]]; then
-      echo 'specify a backup type!'
-      exit 1
-    fi
-
-    DIR=`mktemp -d`
-    trap "rm -rf $DIR" EXIT
-    cd $DIR
-
-    mkdir "${hostname}"
-    pushd "${hostname}"
-
-    ${concatStringsSep "\n" (mapAttrsToList (runScript "bash -e -o pipefail") cfg.scripts)}
-    ${concatStringsSep "\n" (mapAttrsToList (runScript "python3") cfg.pythonScripts)}
-
-    popd
-
-    if ! time duplicity --s3-european-buckets --s3-use-multiprocessing --s3-use-new-style --verbosity notice "$BACKUP_TYPE" "${hostname}" "boto3+s3://barrucadu-backups/${hostname}"; then
-      fail "Backup upload failed"
-    fi
-  '';
-
-  servicePath = with pkgs; [
-    awscli
-    bash
-    coreutils
-    curl
-    (if config.nixfiles.oci-containers.backend == "docker" then docker else podman)
-    duplicity
-    git
-    gnutar
-    gzip
-    jq
-    openssh
-    python3
-    systemd
-  ];
-
-  serviceConfig = type: {
-    ExecStart = "${script} ${type}";
-    EnvironmentFile = cfg.environmentFile;
-    User = cfg.user;
-    Group = cfg.group;
-  };
-in
-{
-  imports = [
-    ./options.nix
-  ];
-
-  config = mkIf cfg.enable {
-    systemd.services.backup-scripts-full = {
-      description = "Take a full backup";
-      startAt = cfg.onCalendarFull;
-      path = servicePath;
-      serviceConfig = serviceConfig "full";
-    };
-
-    systemd.services.backup-scripts-incr = {
-      description = "Take an incremental backup";
-      startAt = cfg.onCalendarIncr;
-      path = servicePath;
-      serviceConfig = serviceConfig "incr";
-    };
-
-    security.sudo.extraRules =
-      let
-        mkRule = rule: {
-          users = [ cfg.user ];
-          runAs = rule.runAs;
-          commands = [{ command = rule.command; options = [ "NOPASSWD" ]; }];
-        };
-        mkChownRule = name: _: mkRule { command = chown name; runAs = "root"; };
-      in
-      map mkRule cfg.sudoRules ++ mapAttrsToList mkChownRule cfg.scripts ++ mapAttrsToList mkChownRule cfg.pythonScripts;
-  };
-}
diff --git a/shared/backups/options.nix b/shared/backups/options.nix
deleted file mode 100644
index 8aaf48fb..00000000
--- a/shared/backups/options.nix
+++ /dev/null
@@ -1,117 +0,0 @@
-{ lib, ... }:
-
-with lib;
-
-{
-  options.nixfiles.backups = {
-    enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = mdDoc ''
-        Enable the backup service.
-      '';
-    };
-
-    scripts = mkOption {
-      type = types.attrsOf types.str;
-      default = { };
-      description = mdDoc ''
-        Attrset of bash scripts to run.  The name is the name of the script's
-        working directory.
-      '';
-    };
-
-    pythonScripts = mkOption {
-      type = types.attrsOf types.str;
-      default = { };
-      description = mdDoc ''
-        Attrset of python scripts to run.  The name is the name of the script's
-        working directory.
-      '';
-    };
-
-    sudoRules = mkOption {
-      type = types.listOf (types.submodule {
-        options = {
-          command = mkOption {
-            type = types.str;
-            description = mdDoc ''
-              The command for which the rule applies.
-            '';
-          };
-          runAs = mkOption {
-            type = types.str;
-            default = "ALL:ALL";
-            description = mdDoc ''
-              The user / group under which the command is allowed to run.
-
-              A user can be specified using just the username: `"foo"`. It is
-              also possible to specify a user/group combination using
-              `"foo:bar"` or to only allow running as a specific group with
-              `":bar"`.
-            '';
-          };
-        };
-      });
-      default = { };
-      description = mdDoc ''
-        List of additional sudo rules to grant the backup user.
-      '';
-    };
-
-    environmentFile = mkOption {
-      type = types.str;
-      description = mdDoc ''
-        Environment file to pass secrets into the service.  This is of the form:
-
-        ```text
-        # Duplicity encryption password
-        PASSPHRASE="..."
-
-        # AWS S3 & SNS credentials
-        AWS_ACCESS_KEY="..."
-        AWS_SECRET_ACCESS_KEY="..."
-        AWS_DEFAULT_REGION="..."
-
-        # SNS topic to send alerts to
-        TOPIC_ARN="..."
-        ```
-
-        If any of the `scripts` or `pythonScripts` need secrets, those should be
-        specified in this file as well.
-      '';
-    };
-
-    onCalendarFull = mkOption {
-      type = types.str;
-      default = "monthly";
-      description = mdDoc ''
-        The cadence of the full backup job.
-      '';
-    };
-
-    onCalendarIncr = mkOption {
-      type = types.str;
-      default = "Mon, 04:00";
-      description = mdDoc ''
-        The cadence of the incremental backup job.
-      '';
-    };
-
-    user = mkOption {
-      type = types.str;
-      default = "barrucadu";
-      description = mdDoc ''
-        The user to generate the backup as.
-      '';
-    };
-
-    group = mkOption {
-      type = types.str;
-      default = "users";
-      description = mdDoc ''
-        The group to generate the backup as.
-      '';
-    };
-  };
-}
diff --git a/shared/bookdb/default.nix b/shared/bookdb/default.nix
index 33ac6aab..91cc8802 100644
--- a/shared/bookdb/default.nix
+++ b/shared/bookdb/default.nix
@@ -64,14 +64,14 @@ in
       group = "nogroup";
     };
 
-    # TODO: figure out how to get `sudo` in the unit's path (adding the
-    # package doesn't help - need the wrapper)
-    nixfiles.backups.scripts.bookdb = ''
-      /run/wrappers/bin/sudo ${pkgs.coreutils}/bin/cp -a ${cfg.dataDir}/covers covers
-      env ES_HOST=${config.systemd.services.bookdb.environment.ES_HOST} ${pkgs.nixfiles.bookdb}/bin/python -m bookdb.index.dump | gzip -9 > dump.json.gz
-    '';
-    nixfiles.backups.sudoRules = [
-      { command = "${pkgs.coreutils}/bin/cp -a ${cfg.dataDir}/covers covers"; }
-    ];
+    nixfiles.restic-backups.backups.bookdb = {
+      prepareCommand = ''
+        env ES_HOST=${config.systemd.services.bookdb.environment.ES_HOST} ${pkgs.nixfiles.bookdb}/bin/python -m bookdb.index.dump > elasticsearch-dump.json
+      '';
+      paths = [
+        cfg.dataDir
+        "elasticsearch-dump.json"
+      ];
+    };
   };
 }
diff --git a/shared/bookmarks/default.nix b/shared/bookmarks/default.nix
index 8813b507..482eb0ee 100644
--- a/shared/bookmarks/default.nix
+++ b/shared/bookmarks/default.nix
@@ -50,8 +50,13 @@ in
       volumes = [{ name = "esdata"; inner = "/usr/share/elasticsearch/data"; }];
     };
 
-    nixfiles.backups.scripts.bookmarks = ''
-      env ES_HOST=http://127.0.0.1:${toString cfg.elasticsearchPort} ${pkgs.nixfiles.bookmarks}/bin/python -m bookmarks.index.dump | gzip -9 > dump.json.gz
-    '';
+    nixfiles.restic-backups.backups.bookmarks = {
+      prepareCommand = ''
+        env ES_HOST=http://127.0.0.1:${toString cfg.elasticsearchPort} ${pkgs.nixfiles.bookmarks}/bin/python -m bookmarks.index.dump > elasticsearch-dump.json
+      '';
+      paths = [
+        "elasticsearch-dump.json"
+      ];
+    };
   };
 }
diff --git a/shared/concourse/default.nix b/shared/concourse/default.nix
index 70348cde..e9cc2dd2 100644
--- a/shared/concourse/default.nix
+++ b/shared/concourse/default.nix
@@ -91,11 +91,16 @@ in
         { name = "Concourse"; folder = "Services"; options.path = ./dashboard.json; }
       ];
 
-    nixfiles.backups.scripts.concourse = ''
-      /run/wrappers/bin/sudo ${backendPkg}/bin/${backend} exec -i concourse-db pg_dump -U concourse --no-owner concourse | gzip -9 > dump.sql.gz
-    '';
-    nixfiles.backups.sudoRules = [
-      { command = "${backendPkg}/bin/${backend} exec -i concourse-db pg_dump -U concourse --no-owner concourse"; }
+    nixfiles.restic-backups.backups.concourse = {
+      prepareCommand = ''
+        /run/wrappers/bin/sudo ${backendPkg}/bin/${backend} exec -i concourse-db pg_dump -U concourse --no-owner -Fc concourse > postgres.dump
+      '';
+      paths = [
+        "postgres.dump"
+      ];
+    };
+    nixfiles.restic-backups.sudoRules = [
+      { command = "${backendPkg}/bin/${backend} exec -i concourse-db pg_dump -U concourse --no-owner -Fc concourse"; }
     ];
   };
 }
diff --git a/shared/default.nix b/shared/default.nix
index 6b3ebc2d..e4668c18 100644
--- a/shared/default.nix
+++ b/shared/default.nix
@@ -25,7 +25,6 @@ in
   imports = [
     ./options.nix
     # modules
-    ./backups
     ./bookdb
     ./bookmarks
     ./concourse
@@ -36,6 +35,7 @@ in
     ./oci-containers
     ./pleroma
     ./resolved
+    ./restic-backups
     ./rtorrent
     ./umami
   ];
diff --git a/shared/foundryvtt/default.nix b/shared/foundryvtt/default.nix
index 470548d3..c1662ae1 100644
--- a/shared/foundryvtt/default.nix
+++ b/shared/foundryvtt/default.nix
@@ -44,19 +44,20 @@ in
       group = "nogroup";
     };
 
-    # TODO: figure out how to get `sudo` in the unit's path (adding the
-    # package doesn't help - need the wrapper)
-    nixfiles.backups.scripts.foundryvtt = ''
-      /run/wrappers/bin/sudo ${pkgs.systemd}/bin/systemctl stop foundryvtt
-      /run/wrappers/bin/sudo ${pkgs.gnutar}/bin/tar cfz bin.tar.gz ${cfg.dataDir}/bin
-      /run/wrappers/bin/sudo ${pkgs.coreutils}/bin/cp -a ${cfg.dataDir}/data data
-      /run/wrappers/bin/sudo ${pkgs.systemd}/bin/systemctl start foundryvtt
-    '';
-    nixfiles.backups.sudoRules = [
+    nixfiles.restic-backups.backups.foundryvtt = {
+      prepareCommand = ''
+        /run/wrappers/bin/sudo ${pkgs.systemd}/bin/systemctl stop foundryvtt
+      '';
+      cleanupCommand = ''
+        /run/wrappers/bin/sudo ${pkgs.systemd}/bin/systemctl start foundryvtt
+      '';
+      paths = [
+        cfg.dataDir
+      ];
+    };
+    nixfiles.restic-backups.sudoRules = [
       { command = "${pkgs.systemd}/bin/systemctl stop foundryvtt"; }
       { command = "${pkgs.systemd}/bin/systemctl start foundryvtt"; }
-      { command = "${pkgs.gnutar}/bin/tar cfz bin.tar.gz ${cfg.dataDir}/bin"; }
-      { command = "${pkgs.coreutils}/bin/cp -a ${cfg.dataDir}/data data"; }
     ];
   };
 }
diff --git a/shared/pleroma/default.nix b/shared/pleroma/default.nix
index 910fea2c..a2c07c72 100644
--- a/shared/pleroma/default.nix
+++ b/shared/pleroma/default.nix
@@ -90,16 +90,16 @@ in
       ];
     };
 
-    # TODO: figure out how to get `sudo` in the unit's path (adding the package
-    # doesn't help - need the wrapper)
-    nixfiles.backups.scripts.pleroma = ''
-      /run/wrappers/bin/sudo ${pkgs.coreutils}/bin/cp -a ${config.users.users.pleroma.home}/uploads uploads
-      /run/wrappers/bin/sudo ${pkgs.coreutils}/bin/cp -a ${config.users.users.pleroma.home}/static/emoji/custom emoji
-      /run/wrappers/bin/sudo ${backendPkg}/bin/${backend} exec -i pleroma-db pg_dump -U pleroma --no-owner -Fc pleroma > postgres.dump
-    '';
-    nixfiles.backups.sudoRules = [
-      { command = "${pkgs.coreutils}/bin/cp -a ${config.users.users.pleroma.home}/uploads uploads"; }
-      { command = "${pkgs.coreutils}/bin/cp -a ${config.users.users.pleroma.home}/static/emoji/custom emoji"; }
+    nixfiles.restic-backups.backups.pleroma = {
+      prepareCommand = ''
+        /run/wrappers/bin/sudo ${backendPkg}/bin/${backend} exec -i pleroma-db pg_dump -U pleroma --no-owner -Fc pleroma > postgres.dump
+      '';
+      paths = [
+        config.users.users.pleroma.home
+        "postgres.dump"
+      ];
+    };
+    nixfiles.restic-backups.sudoRules = [
       { command = "${backendPkg}/bin/${backend} exec -i pleroma-db pg_dump -U pleroma --no-owner -Fc pleroma"; }
     ];
   };
diff --git a/shared/restic-backups/default.nix b/shared/restic-backups/default.nix
new file mode 100644
index 00000000..27af485d
--- /dev/null
+++ b/shared/restic-backups/default.nix
@@ -0,0 +1,132 @@
+# Manage regular incremental, compressed, and encrypted backups with [restic][].
+#
+# Backups are uploaded to the `barrucadu-backups-a19c48` [B2][] bucket.
+#
+# List all the snapshots with:
+#
+# ```bash
+# nix run .#backups                                # all snapshots
+# nix run .#backups -- snapshots --host <hostname> # for a specific host
+# nix run .#backups -- snapshots --tag <tag>       # for a specific tag
+# ```
+#
+# Restore a snapshot to `<restore-dir>` with:
+#
+# ```bash
+# nix run .#backups restore <snapshot> [<restore-dir>]
+# ```
+#
+# If unspecified, the snapshot is restored to `/tmp/restic-restore-<snapshot>`.
+#
+# **Alerts:**
+#
+# - Creating or uploading a snapshot fails.
+#
+# [restic]: https://restic.net/
+# [B2]: https://www.backblaze.com/
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  repo = "b2:barrucadu-backups-a19c48:nixfiles/restic";
+
+  cfg = config.nixfiles.restic-backups;
+
+  mkSudoRule = rule: {
+    users = [ config.users.users.backups.name ];
+    runAs = rule.runAs;
+    commands = [{ command = rule.command; options = [ "NOPASSWD" ]; }];
+  };
+
+  mkBackup = name: options:
+    let
+      serviceName = "restic-backups-${name}";
+      filesFrom = "/run/${serviceName}/includes";
+    in
+    nameValuePair serviceName {
+      inherit (options) startAt;
+      environment = {
+        RESTIC_CACHE_DIR = "%C/${serviceName}";
+        RESTIC_REPOSITORY = repo;
+      };
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.restic}/bin/restic backup --tag ${name} --files-from=${filesFrom}";
+        User = config.users.users.backups.name;
+        CacheDirectory = serviceName;
+        CacheDirectoryMode = "0700";
+        RuntimeDirectory = "${serviceName} ${serviceName}/generated-files";
+        WorkingDirectory = "/run/${serviceName}/generated-files";
+        PrivateTmp = true;
+        EnvironmentFile = cfg.environmentFile;
+        AmbientCapabilities = "CAP_DAC_READ_SEARCH";
+      };
+      preStart = ''
+        cat ${pkgs.writeText "paths" (concatStringsSep "\n" options.paths)} > ${filesFrom}
+        ${optionalString (options.prepareCommand != null) options.prepareCommand}
+      '';
+      postStop = ''
+        if [[ "$SERVICE_RESULT" != "success" ]]; then
+          ${pkgs.awscli}/bin/aws sns publish \
+            --topic-arn "arn:aws:sns:eu-west-1:197544591260:host-notifications" \
+            --subject "Alert: ${config.networking.hostName}" \
+            --message "${name} backup failed: ''${SERVICE_RESULT}"
+        fi
+
+        ${pkgs.coreutils}/bin/rm ${filesFrom}
+        ${optionalString (options.cleanupCommand != null) options.cleanupCommand}
+      '';
+    };
+
+  checkService =
+    let
+      serviceName = "restic-check";
+    in
+    {
+      environment = {
+        RESTIC_CACHE_DIR = "%C/${serviceName}";
+        RESTIC_REPOSITORY = repo;
+      };
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      startAt = cfg.checkRepositoryAt;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.restic}/bin/restic check";
+        User = config.users.users.backups.name;
+        RuntimeDirectory = serviceName;
+        CacheDirectory = serviceName;
+        CacheDirectoryMode = "0700";
+        PrivateTmp = true;
+        EnvironmentFile = cfg.environmentFile;
+      };
+      postStop = ''
+        if [[ "$SERVICE_RESULT" != "success" ]]; then
+          ${pkgs.awscli}/bin/aws sns publish \
+            --topic-arn "arn:aws:sns:eu-west-1:197544591260:host-notifications" \
+            --subject "Alert: ${config.networking.hostName}" \
+            --message "restic-check service failed: ''${SERVICE_RESULT}"
+        fi
+      '';
+    };
+in
+{
+  imports = [
+    ./options.nix
+  ];
+
+  config = mkIf cfg.enable {
+    users.users.backups = {
+      description = "backup service user";
+      isSystemUser = true;
+      group = "nogroup";
+    };
+
+    security.sudo.extraRules = map mkSudoRule cfg.sudoRules;
+
+    systemd.services = mapAttrs' mkBackup cfg.backups // (if cfg.checkRepositoryAt == null then { } else { "restic-check" = checkService; });
+  };
+}
diff --git a/shared/restic-backups/options.nix b/shared/restic-backups/options.nix
new file mode 100644
index 00000000..12b97666
--- /dev/null
+++ b/shared/restic-backups/options.nix
@@ -0,0 +1,120 @@
+{ lib, ... }:
+
+with lib;
+
+let
+  backupOptions = {
+    paths = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = mdDoc ''
+        List of paths to back up.
+      '';
+    };
+
+    prepareCommand = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = mdDoc ''
+        A script to run before beginning the backup.
+      '';
+    };
+
+    cleanupCommand = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = mdDoc ''
+        A script to run after taking the backup.
+      '';
+    };
+
+    startAt = mkOption {
+      type = types.str;
+      default = "Mon, 04:00";
+      description = mdDoc ''
+        When to run the backup.
+      '';
+    };
+  };
+
+  sudoRuleOptions = {
+    command = mkOption {
+      type = types.str;
+      description = mdDoc ''
+        The command for which the rule applies.
+      '';
+    };
+
+    runAs = mkOption {
+      type = types.str;
+      default = "ALL:ALL";
+      description = mdDoc ''
+        The user / group under which the command is allowed to run.
+
+        A user can be specified using just the username: `"foo"`. It is also
+        possible to specify a user/group combination using `"foo:bar"` or to
+        only allow running as a specific group with `":bar"`.
+      '';
+    };
+  };
+in
+{
+  options.nixfiles.restic-backups = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = mdDoc ''
+        Enable the backup service.
+      '';
+    };
+
+    backups = mkOption {
+      type = types.attrsOf (types.submodule { options = backupOptions; });
+      default = { };
+      description = mdDoc ''
+        Attrset of backup job definitions.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.str;
+      description = mdDoc ''
+        Environment file to pass secrets into the service.  This is of the form:
+
+        ```text
+        # Repository password
+        RESTIC_PASSWORD="..."
+
+        # B2 credentials
+        B2_ACCOUNT_ID="..."
+        B2_ACCOUNT_KEY="..."
+
+        # AWS SNS credentials
+        AWS_ACCESS_KEY="..."
+        AWS_SECRET_ACCESS_KEY="..."
+        AWS_DEFAULT_REGION="..."
+        ```
+
+        If any of the backup jobs need secrets, those should be specified in
+        this file as well.
+      '';
+    };
+
+    sudoRules = mkOption {
+      type = types.listOf (types.submodule { options = sudoRuleOptions; });
+      default = [ ];
+      description = mdDoc ''
+        List of additional sudo rules to grant the backup user.
+      '';
+    };
+
+    checkRepositoryAt = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = mdDoc ''
+        If not null, when to run `restic check` to validate the repository
+        metadata.
+      '';
+    };
+  };
+}
diff --git a/shared/umami/default.nix b/shared/umami/default.nix
index d86c9170..62bb2ef1 100644
--- a/shared/umami/default.nix
+++ b/shared/umami/default.nix
@@ -42,11 +42,16 @@ in
       };
     };
 
-    nixfiles.backups.scripts.umami = ''
-      /run/wrappers/bin/sudo ${backendPkg}/bin/${backend} exec -i umami-db pg_dump -U umami --no-owner umami | gzip -9 > dump.sql.gz
-    '';
-    nixfiles.backups.sudoRules = [
-      { command = "${backendPkg}/bin/${backend} exec -i umami-db pg_dump -U umami --no-owner umami"; }
+    nixfiles.restic-backups.backups.umami = {
+      prepareCommand = ''
+        /run/wrappers/bin/sudo ${backendPkg}/bin/${backend} exec -i umami-db pg_dump -U umami --no-owner -Fc umami > postgres.dump
+      '';
+      paths = [
+        "postgres.dump"
+      ];
+    };
+    nixfiles.restic-backups.sudoRules = [
+      { command = "${backendPkg}/bin/${backend} exec -i umami-db pg_dump -U umami --no-owner -Fc umami"; }
     ];
   };
 }