diff --git a/hosts/elisabeth/secrets/immich/generated/immichHetznerSsh.age b/hosts/elisabeth/secrets/immich/generated/immichHetznerSsh.age
new file mode 100644
index 0000000..a35f1f8
--- /dev/null
+++ b/hosts/elisabeth/secrets/immich/generated/immichHetznerSsh.age
@@ -0,0 +1,18 @@
+age-encryption.org/v1
+-> X25519 WB1xLsDy77zdrPl9eUQ0p3SB1GyhaLb5RVHC2xLeh2U
+CLCt7Ft9zw0sVN5xmnz5IdGJYj2n60u9G0Mw7yhlp1Y
+-> piv-p256 XTQkUA ArpAo5Lw+iL+JGsI1YhkRyV/Mf5aNbFzw4vbzKDRRKhP
++7OPvZxHU8JmdyfR8DVrhPpmp1WqkqhGuI+zNUwURzc
+-> piv-p256 ZFgiIw AwihFvG6Qtg+GdQH1diMas21FrrnLdcLVFFIWrg9LoHv
+pnqnXdeiazBwe/WLIRCjzB6sInrH1PF8yFdz7omqS70
+-> piv-p256 5vmPtQ A6eL3RiHO5GPIHYkc8FLap+wJMr6RWKFCUiLfvTbmJRd
+d6Mfa5eJa76cLocePgTzp26b/w5B/S7EAqPniKMnxZ8
+-> piv-p256 ZFgiIw AgXMXffPLAIrCJeTYA4kknA84KJfEYZOSjI4tPoMRsfo
+LdYKnUoQdY7JCpuq20S1e9xWS6X9IyMZvEQqfc6HJdc
+-> @ao.u7t]-grease
+sXjdduaavhXpG1XbPlM28CVJyDyVlT0SWY4xi2qgNK9L2W4aAeQ192bzhMAR2iY3
+jWHPGApnULPsA8vjoskwrC8
+--- me+7MliHVc3ogEKqFM7z0MUl/PyOJ+NiAjxrAVFHH5Q
+S�b27z������Kħ
+��j	Gc�ڟ�C"P��ve"R��U�r/���I�J���#��㭚|�8i��� ?M�T�s�O���0���c��M߁C�n���|c�ӚG֝w��֮G���ݎ���9�/�O}Vr�D�Q�Knx��;�2d�`^�a�⫲�a�Z!*'��baG6vL�W�>���`6��cUB:'��Q�
2�<��uHRQ���&J�~�^}��-���(�s�w�|Ώ�.0%v��|N�*B�,KA�n���,���L���H�bi�7i������OM��X��Uk4Y��H���v�
\x^�g�Җ,A��{IpnҔ��cEW��[y:���SW��'�x�r���LE��9��i=oP�O�23
+��S�9[jr]�'|�)
ڇ�w��	��
EV�1�L[����7R������:Nޡ��-�/�'|c�t���rXB(�f3�$g�
\ No newline at end of file
diff --git a/hosts/elisabeth/secrets/immich/generated/resticpasswd.age b/hosts/elisabeth/secrets/immich/generated/resticpasswd.age
new file mode 100644
index 0000000..3325324
--- /dev/null
+++ b/hosts/elisabeth/secrets/immich/generated/resticpasswd.age
@@ -0,0 +1,15 @@
+age-encryption.org/v1
+-> X25519 4tPfPyE54oSMuhqmfrTTCJQdCJAzryGgdmjBr04yzkA
+wsvnurkIbkDSIE6ZQdP0jtPn8hYxvNm/p1Jettzcf3Q
+-> piv-p256 XTQkUA AsBlQ0gJ2gKWhMEbxRLXPJ9RmaK6ufETgfrq3fnJxbGT
+L7gXAPRHn5GG94JXZCPhr6MH2tZMDLTs+ac+Zzm7ZRI
+-> piv-p256 ZFgiIw A60jY/C+OJzW2wD343YUMiONDhUhIs1rBAutn8ai0xmx
+od/edlvok9J0IjzeTkRanm6udkzvN9v2SGSU3d+uk6c
+-> piv-p256 5vmPtQ AwUMrlxQ5uKe/YwIcBaypG+DnyrGZVmkaafRGqwAKBbS
+KvrODcNRDmvZhk0KUh0WwyP4XUoCq/rWPwemBrKkKog
+-> piv-p256 ZFgiIw AwN8CB3pEUeOcPPJIArgo3y0K7SZTiOlaK69257RSaph
+GDIXUvPrBDG2hQ9uvPYj9Lb4eDW30lTI9PNBCVLbmkQ
+-> \v~O9~-grease
+xw
+--- cTlXPGvRSzDL4DQlGTkX5VQZ/84vqMvIW3cEh0TIOdM
+X�"�����&�bm�&Je�2��O�@�Y�ky��L�⋘Q6@��o�&h�qhؖ���%u�
}Ye���T5y����5��
\ No newline at end of file
diff --git a/modules/services/immich.nix b/modules/services/immich.nix
index 1e3df4c..aeddfb3 100644
--- a/modules/services/immich.nix
+++ b/modules/services/immich.nix
@@ -46,6 +46,45 @@
     ];
   };
 in {
+  age.secrets.resticpasswd = {
+    generator.script = "alnum";
+  };
+  age.secrets.immichHetznerSsh = {
+    generator.script = "ssh-ed25519";
+  };
+  services.restic.backups = {
+    main = {
+      user = "root";
+      timerConfig = {
+        OnCalendar = "06:00";
+        Persistent = true;
+        RandomizedDelaySec = "3h";
+      };
+      initialize = true;
+      passwordFile = config.age.secrets.resticpasswd.path;
+      hetznerStorageBox = {
+        enable = true;
+        inherit (config.secrets.secrets.global.hetzner) mainUser;
+        inherit (config.secrets.secrets.global.hetzner.users.immich) subUid path;
+        sshAgeSecret = "immichHetznerSsh";
+      };
+      backupPrepareCommand = ''
+        ${pkgs.podman}/bin/podman exec -t immich_postgres pg_dumpall -c -U postgres > /run/immich_dump.sql
+      '';
+      paths = [
+        "${upload_folder}/library"
+        "${upload_folder}/upload"
+        "${upload_folder}/profile"
+        "/run/immich_dump.sql"
+      ];
+      pruneOpts = [
+        "--keep-daily 10"
+        "--keep-weekly 7"
+        "--keep-monthly 12"
+        "--keep-yearly 75"
+      ];
+    };
+  };
   microvm = {
     mem = 1024 * 8;
     vcpu = 12;
diff --git a/secrets/secrets.nix.age b/secrets/secrets.nix.age
index d4e15b2..96f06fd 100644
Binary files a/secrets/secrets.nix.age and b/secrets/secrets.nix.age differ