diff --git a/hosts/homeserver/configuration.nix b/hosts/homeserver/configuration.nix
index 6865fb2..84bae82 100644
--- a/hosts/homeserver/configuration.nix
+++ b/hosts/homeserver/configuration.nix
@@ -13,6 +13,7 @@
       ./services/newt.nix
       ./services/postgres.nix
       ./services/nextcloud.nix
+      ./services/backup.nix
     ];
 
   # Bootloader.
@@ -118,11 +119,16 @@
   # List packages installed in system profile. To search, run:
   # $ nix search wget
   environment.systemPackages = with pkgs; [
-     btop
      docker-compose
+     sops
+
      git
      just
-     sops
+
+     btop
+     dust
+
+     restic
 
      # Power efficient
      powertop
diff --git a/hosts/homeserver/secrets.yaml b/hosts/homeserver/secrets.yaml
index 8711016..2e06810 100644
--- a/hosts/homeserver/secrets.yaml
+++ b/hosts/homeserver/secrets.yaml
@@ -19,6 +19,8 @@ newt_id: ENC[AES256_GCM,data:BT6BpUWzJ39OpHnhKt5Y,iv:qSy1GiZP9m7MXw3HlYOHHCWxmmi
 newt_secret: ENC[AES256_GCM,data:qLaeYhO6bt0tSJAwNhwSMxIr416Od4AksSg5XZ7X7gy5+VpsLKNMg2v9XmMMhxs8,iv:L56pg4smT0D7Jm+KWq7BAXueYpHNGDjyD150lZYOwMw=,tag:ssgaGQsglXX2P+bBt2iQLQ==,type:str]
 #ENC[AES256_GCM,data:J/jmWOlM8htJBg==,iv:bjlbUOJNXZcU4HXJVONsvPLOxIoLff6D+UJnrtxCpZE=,tag:JPAar1Qy/DxEr0ccG64EKA==,type:comment]
 nextcloud_admin_password: ENC[AES256_GCM,data:VHcdwclX/F7awXAT8wWXfmGLWnbrB7Ac,iv:R2jSjaX4CMlWxpDRwVrE7YEMErYQUX6HMENMxJp9ggw=,tag:C8yOemdOsFQl3CoXQJntYA==,type:str]
+#ENC[AES256_GCM,data:KYJNIEZMTQ==,iv:MbTQlzlTX7i4TB2hnvkts3kJ+xwdgiFLB2LSzAbexAs=,tag:kg6UIdDfPXY8skaex0JSvA==,type:comment]
+restic_password: ENC[AES256_GCM,data:KOkaDvfS45O6xpS1JU4=,iv:LxeovfjYsHLkmXV8fIKvbOWttAz7CBRXxwwcMaGJ2lA=,tag:V7PcE4EXqsobEx+biliDYA==,type:str]
 sops:
     age:
         - enc: |
@@ -30,7 +32,7 @@ sops:
             ymzV/vprvtzMGSPZLLwURHKO8PZBZ7VV8zL/wGSxFcposVnLwo5qFQ==
             -----END AGE ENCRYPTED FILE-----
           recipient: age185ejn50rqg7tnzcrkp5f9w7p6vf4ex3k9k472xlyvpenanrgnv4q6kyx9n
-    lastmodified: "2026-06-13T14:29:25Z"
-    mac: ENC[AES256_GCM,data:ZzWRnSa4SpZ80okU76h8NstCoC7Uuineiw27Ykivz9FLJd8vu0/Ko9dudvbdCVxoHcotoo1kiiGeubRNf/RGrL2Lji8VW1sd5ufI6UMGh2JGOXTqFmsSvYw4Vlf9psrFvIy76aYf1TlAnd09e5fmmbQtPIYwZr/HAUpJGk1cXr0=,iv:8eWsleyFiroo6/HBGUFRDIXSZyEkHhVG8bTEin7y3rg=,tag:xAMTGIjoe/mdfLRaA7TOoA==,type:str]
+    lastmodified: "2026-06-19T07:21:47Z"
+    mac: ENC[AES256_GCM,data:0XKRsWYWUJW6d2Pkq1WonmTiT+h9kNhTYE4vrPOqp3awsPcGh+A+zjhrnjmr16J3tI2bRhR6FGWTqM4bFYi4oGbCzNamj4gIB9JJXEmd2Z6wp/i+S3B8EubPtadguZyz84pFjB813bOTuGsjzjIt2A7hgh7p1MJnKXls4fwbaWc=,iv:5YMIlCDH+K8MKXkFoCSk1tZu6nifkbExa+NtYGElfcE=,tag:ft4GT3FtEsTjLdStEge+0Q==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1
diff --git a/hosts/homeserver/services/backup.nix b/hosts/homeserver/services/backup.nix
new file mode 100644
index 0000000..668368b
--- /dev/null
+++ b/hosts/homeserver/services/backup.nix
@@ -0,0 +1,40 @@
+{ config, pkgs, ... }:
+
+{
+  sops.secrets = {
+    restic_password = {};
+  };
+
+  services.postgresqlBackup= {
+    enable = true;
+    startAt = "01:30:00"; # (30 mins before Restic)
+    location = "/var/backup/postgresql";
+  };
+
+  services.restic.backups = {
+    vps-remote = {
+      initialize = true;
+      passwordFile = config.sops.secrets."restic_password".path;
+      repository = "sftp:backupuser@ssh.tobinio.dev:/home/backupuser/homeserver-backups";
+
+      paths = [
+        "/srv"
+        "/var/backup/postgresql"
+      ];
+
+      extraBackupArgs = [
+        "--exclude='/srv/postgresql'"
+        "--exclude='/srv/nextcloud/data'"
+      ];
+
+      timerConfig = {
+        OnCalendar = "02:00:00";
+        Persistent = true;
+      };
+
+      pruneOpts = [
+        "--keep-daily 7"
+      ];
+    };
+  };
+}
diff --git a/hosts/homeserver/services/nextcloud.nix b/hosts/homeserver/services/nextcloud.nix
index 31c311a..aac9c75 100644
--- a/hosts/homeserver/services/nextcloud.nix
+++ b/hosts/homeserver/services/nextcloud.nix
@@ -1,8 +1,8 @@
 { config, pkgs, ... }:
 {
-  sops.secrets = {
-    nextcloud_admin_password = {};
-  };
+    sops.secrets = {
+        nextcloud_admin_password = {};
+    };
 
     services.nextcloud = {
         enable = true;
diff --git a/hosts/homeserver/services/postgres.nix b/hosts/homeserver/services/postgres.nix
index 0e87232..35cc347 100644
--- a/hosts/homeserver/services/postgres.nix
+++ b/hosts/homeserver/services/postgres.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 {
     services.postgresql = {
         enable = true;
@@ -12,6 +12,19 @@
                 name = "nextcloud";
                 ensureDBOwnership = true;
             }
+            {
+                name = "admin";
+            }
         ];
+
+        authentication = pkgs.lib.mkOverride 10 ''
+            #type database  DBuser  auth-method
+
+            local all postgres peer
+            local nextcloud nextcloud peer
+
+            host all admin 127.0.0.1/32 scram-sha-256
+            host all admin ::1/128 scram-sha-256
+        '';
     };
 }
diff --git a/hosts/homeserver/services/taskline.compose.yml b/hosts/homeserver/services/taskline.compose.yml
index 52ed642..f3144f6 100644
--- a/hosts/homeserver/services/taskline.compose.yml
+++ b/hosts/homeserver/services/taskline.compose.yml
@@ -1,6 +1,6 @@
 services:
   nuxt:
-    image: atcr.io/tobinio.dev/task-line/nuxt:v2.4.1
+    image: atcr.io/tobinio.dev/task-line/nuxt:v2.4.2
     restart: always
     ports:
     - 3003:3000
@@ -9,7 +9,7 @@ services:
     volumes:
     - /srv/apps/taskline/data:/app/.data
   api:
-    image: atcr.io/tobinio.dev/task-line/api:v2.4.1
+    image: atcr.io/tobinio.dev/task-line/api:v2.4.2
     restart: always
     ports:
     - 3001:8080