diff --git a/configs/home-manager/mpd.nix b/configs/home-manager/mpd.nix
index 57139e8..3630cc4 100644
--- a/configs/home-manager/mpd.nix
+++ b/configs/home-manager/mpd.nix
@@ -3,38 +3,44 @@
   pkgs,
   lib,
   ...
-}: {
+}: let
+  visualizer = false;
+in {
   services.mpd = {
     enable = true;
     musicDirectory = "${config.home.homeDirectory}/Music";
     network.startWhenNeeded = true;
     playlistDirectory = "${config.services.mpd.musicDirectory}/.mpd/playlists";
-    extraConfig = ''
-      restore_paused "yes"
-      auto_update "yes"
-      replaygain "auto"
-      follow_outside_symlinks "yes"
+    extraConfig =
+      (''
+        restore_paused "yes"
+        auto_update "yes"
+        replaygain "auto"
+        follow_outside_symlinks "yes"
 
-      #for ncmpcpp visualizer
-      audio_output {
-          type "fifo"
-          name "Visualizer feed"
-          path "/tmp/mpd.fifo"
-          format "44100:16:2"
-      }
-      audio_output {
-        type "pipewire"
-        name "PipeWire Sound Server"
-      }
-    '';
+        audio_output {
+          type "pipewire"
+          name "PipeWire Sound Server"
+        }
+      ''
+       + lib.optionalString visualizer
+      ''
+        #for ncmpcpp visualizer
+        audio_output {
+            type "fifo"
+            name "Visualizer feed"
+            path "/tmp/mpd.fifo"
+            format "44100:16:2"
+        }
+      ''); 
   };
 
   services.mpd-mpris.enable = true;
 
   programs.ncmpcpp = {
     enable = true;
-    package = pkgs.ncmpcpp.override {visualizerSupport = true;};
-    settings = {
+    package = lib.mkIf visualizer (pkgs.ncmpcpp.override {visualizerSupport = true;});
+    settings = lib.mkIf visualizer {
       visualizer_data_source = "/tmp/mpd.fifo";
       visualizer_output_name = "Visualizer feed";
       visualizer_in_stereo = "yes";
diff --git a/hosts/cirrostratus/default.nix b/hosts/cirrostratus/default.nix
index 442b257..491fae0 100644
--- a/hosts/cirrostratus/default.nix
+++ b/hosts/cirrostratus/default.nix
@@ -60,6 +60,10 @@ inputs.nixpkgs.lib.nixosSystem {
             format = "binary";
             owner = config.services.nginx.user;
           };
+          restic-server-credentials = {
+            sopsFile = "${inputs.nix-secrets}/restic-server";
+            format = "binary";
+          };
         };
       };
 
diff --git a/hosts/cirrostratus/disk-config.nix b/hosts/cirrostratus/disk-config.nix
index cb72fd7..675d149 100644
--- a/hosts/cirrostratus/disk-config.nix
+++ b/hosts/cirrostratus/disk-config.nix
@@ -68,6 +68,16 @@
           compression = "zstd";
           mountpoint = "/storage";
         };
+        datasets = {
+          backup = {
+            type="zfs_fs";
+            options={
+              mountpoint="/backup";
+              compression="zstd";
+              quota="6T";
+            };
+          };
+        };
       };
     };
   };
diff --git a/hosts/cirrostratus/nginx.nix b/hosts/cirrostratus/nginx.nix
index 1f2cda3..284c38a 100644
--- a/hosts/cirrostratus/nginx.nix
+++ b/hosts/cirrostratus/nginx.nix
@@ -8,15 +8,17 @@
   imports = [
     ../../configs/nixos/nginx.nix
   ];
-  services.nginx.virtualHosts."gabevenberg.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = "/var/www/gabevenberg.com";
-  };
-  services.nginx.virtualHosts."draft.gabevenberg.com" = {
-    enableACME = true;
-    forceSSL = true;
-    root = "/var/www/draft.gabevenberg.com";
-    basicAuthFile = config.sops.secrets.gabevenberg-draft-credentials.path;
+  services.nginx.virtualHosts = {
+    "gabevenberg.com" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/gabevenberg.com";
+    };
+    "draft.gabevenberg.com" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/var/www/draft.gabevenberg.com";
+      basicAuthFile = config.sops.secrets.gabevenberg-draft-credentials.path;
+    };
   };
 }
diff --git a/hosts/cirrostratus/restic.nix b/hosts/cirrostratus/restic.nix
new file mode 100644
index 0000000..6d6cdc9
--- /dev/null
+++ b/hosts/cirrostratus/restic.nix
@@ -0,0 +1,27 @@
+{
+  inputs,
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  port = "8090";
+in {
+  services.restic.server = {
+    enable = true;
+    appendOnly = true;
+    dataDir = "/backup/restic";
+    extraFlags = [
+      "--htpasswd-file ${config.sops.secrets.gabevenberg-draft-credentials.path}"
+      "--private-repos"
+    ];
+    listenAddress = "127.0.0.1:${port}";
+  };
+  services.nginx.virtualHosts."restic.gabevenberg.com" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://localhost:${port}";
+    };
+  };
+}