diff --git a/nix/os/containers/backup.nix b/nix/os/containers/backup.nix
index 6ade22f..3ac35d9 100644
--- a/nix/os/containers/backup.nix
+++ b/nix/os/containers/backup.nix
@@ -1,70 +1,13 @@
 { config
 , hostAddress
 , localAddress
+, subvolumes
+, targetPathSuffix ? ""
 }:
 
 let
-  unstablepkgs = import <channels-nixos-unstable> { config = config.nixpkgs.config; };
-
   passwords = import ../../variables/passwords.crypt.nix;
-  bucket = "bkp";
-  subvolumeParentDir = "/var/lib";
-
-  subvolumeDir = "/var/lib/container-volumes";
-  subvolumeSnapshot = "/var/lib/container-volumes.snapshot";
-
-  bkpSource = subvolumeSnapshot;
-  bkpDestination = "/container/backup";
-  cacheDir = "/var/lib/rclone-cachedir";
-
-  wasabiRc = pkgs: pkgs.writeText "rc" ''
-    [wasabi-${bucket}]
-    type = s3
-    provider = Wasabi
-    env_auth = false
-
-    #bkp user
-    access_key_id = ${passwords.storage.wasabi.bkp.key}
-    secret_access_key = ${passwords.storage.wasabi.bkp.secret}
-
-    region = us-east-1
-    endpoint = s3.wasabisys.com
-    location_constraint =
-    acl =
-    server_side_encryption =
-    storage_class =
-  '';
-
-
-  bkp-mount-rclone-manual = pkgs: {
-      enable = true;
-      description = "bkp-mount-rclone-manual service";
-      path = with pkgs; [ unstablepkgs.rclone utillinux ];
-      serviceConfig = {
-        Type = "notify";
-      };
-      script = ''
-        export PATH="$PATH:/run/wrappers/bin"
-        exec rclone --config ${wasabiRc pkgs} mount wasabi-${bucket}:${bucket} ${bkpDestination} \
-                    --stats=50m --stats-log-level=NOTICE \
-                    --cache-dir=${cacheDir} \
-                    --vfs-cache-mode=full
-
-      '';
-      preStart  = ''
-          mkdir -p ${bkpDestination}
-          mkdir -p ${cacheDir}
-      '';
-      postStop = ''
-          sync
-          umount ${bkpDestination} \
-            || umount -l ${bkpDestination} \
-            || :
-
-          rmdir ${bkpDestination}
-      '';
-    };
-
+  subvolumeParentDir = "/var/lib/container-volumes";
 
 in {
   config = { pkgs, ... }: {
@@ -74,18 +17,14 @@ in {
 
     environment.systemPackages = with pkgs; [
       btrfs-progs
-      rdup rdedup
-      iptraf-ng nethogs
-      rclone
+      btrbk
     ];
 
     networking.firewall.enable = true;
 
-    systemd.services."bkp-mount-rclone-manual" = bkp-mount-rclone-manual pkgs;
-
-    systemd.services."bkp-sync-rclone" = {
+    systemd.services."bkp-sync" = {
       enable = true;
-      description = "bkp-sync-rclone service";
+      description = "bkp-sync service";
 
       serviceConfig = {
         Type = "oneshot";
@@ -99,14 +38,10 @@ in {
         "bkp-run.service"
       ];
 
-      path = with pkgs; [ unstablepkgs.rclone utillinux ];
+      path = with pkgs; [ utillinux ];
       script = ''
         set -x
-        echo Starting rclone sync...
-        rclone --config ${wasabiRc pkgs} sync \
-          ${bkpDestination}/rdedup/ wasabi-${bucket}:${bucket}/rdedup/  \
-            --stats=50m --stats-log-level=WARNING
-        echo Finished rclone sync...
+        true
       '';
     };
 
@@ -119,41 +54,35 @@ in {
       };
 
       partOf = [
-        "bkp-sync-rclone.service"
+        "bkp-sync.service"
       ];
 
-      path = with pkgs; [ btrfs-progs rdup rdedup coreutils ];
-      preStart = ''
-        echo Creating new btrfs snapshot of ${subvolumeDir} at ${subvolumeSnapshot}
-        btrfs subvolume snapshot -r ${subvolumeDir} ${subvolumeSnapshot}
-      '';
-      script = ''
+      path = with pkgs; [ btrfs-progs btrbk coreutils ];
+
+      script = let 
+        bktrbkConf = pkgs.writeText "cfg" ''
+          timestamp_format long
+          ssh_identity ${passwords.storage.homeChBackup.keyPath}
+          ssh_user ${passwords.storage.homeChBackup.user}
+          ssh_compression no
+          backend_remote btrfs-progs-sudo
+          compat_remote busybox
+          btrfs_commit_delete each
+          snapshot_create onchange
+          snapshot_preserve_min latest
+          snapshot_preserve 7d 4w
+          target_preserve_min no
+          target_preserve 7d 4w 12m *y
+
+          volume ${subvolumeParentDir}
+            target ${passwords.storage.homeChBackup.target}/container-volumes/${targetPathSuffix}
+          ${builtins.foldl' (sum: elem: sum + "  subvolume " + elem + "\n") "" subvolumes}
+        '';
+      in ''
         #! ${pkgs.bash}/bin/bash
         set -Eeuxo pipefail
 
-        export RUST_BACKTRACE=1
-        export TIMESTAMP=$(date +"%Y%m%d.%H%M%S")
-
-        echo Starting rdup/rdedup backup...
-        for d in `ls -1 ${bkpSource}`; do
-          echo Determining backup source size ${bkpSource}/$d...
-          du -hs ${bkpSource}/$d
-          rdup -x /dev/null ${bkpSource}/$d | rdedup -v -ttt --dir=${bkpDestination}/rdedup store $d-''${TIMESTAMP}
-        done
-        sync
-        echo Finished rdup/rdedup backup...
-
-        echo Removing all previous backups...
-        rdedup --dir=${bkpDestination}/rdedup list | grep -v ''${TIMESTAMP} | xargs echo rdedup --dir=${bkpDestination}/rdedup remove
-
-        echo Running rdedup garbage-collector...
-        time rdedup -v -ttt --dir=${bkpDestination}/rdedup gc
-
-        echo Determining backup destination size ${bkpDestination}/rdedup...
-        du -hs ${bkpDestination}/rdedup
-      '';
-      postStop = ''
-        btrfs subvolume delete ${subvolumeSnapshot}
+        btrbk -c ${bktrbkConf} --progress ''${@:-run}
       '';
     };
 
@@ -164,9 +93,9 @@ in {
       timerConfig = {
         # Obtained using `systemd-analyze calendar "Wed 23:00"`
         # OnCalendar = "Wed *-*-* 23:00:00";
-        OnStartupSec="2d";
-        Unit = "bkp-sync-rclone.service";
-        OnUnitInactiveSec="2d";
+        OnStartupSec="1m";
+        Unit = "bkp-sync.service";
+        OnUnitInactiveSec="2h";
         Persistent="true";
       };
     };
@@ -176,10 +105,15 @@ in {
 
   bindMounts = {
     "${subvolumeParentDir}" = {
-      hostPath = "/var/lib/";
+      hostPath = subvolumeParentDir;
       isReadOnly = false;
     };
 
+    "/etc/secrets/" = {
+      hostPath = "/var/lib/container-volumes/backup/etc-secrets";
+      isReadOnly = true;
+    };
+
     "/dev/fuse" = {
       hostPath = "/dev/fuse";
       isReadOnly = false;
diff --git a/nix/os/containers/syncthing.nix b/nix/os/containers/syncthing.nix
index 9ab498a..c9d8eaf 100644
--- a/nix/os/containers/syncthing.nix
+++ b/nix/os/containers/syncthing.nix
@@ -1,6 +1,7 @@
 { hostAddress
 , localAddress
 , syncthingPort ? 22000
+, syncthingLocalAnnouncePort ? 21027
 }:
 
 {
@@ -39,6 +40,11 @@
       hostPort = syncthingPort;
       protocol = "tcp";
     }
+    {
+      containerPort = 21027;
+      hostPort = syncthingLocalAnnouncePort;
+      protocol = "tcp";
+    }
   ];
 
   inherit hostAddress localAddress;
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix
new file mode 100644
index 0000000..cd4c05f
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/boot.nix
@@ -0,0 +1,8 @@
+{ lib
+, ...
+}:
+
+{
+  boot.loader.grub.efiSupport = true;
+  boot.extraModulePackages = [ ];
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix
new file mode 100644
index 0000000..b681c06
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/configuration.nix
@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  disabledModules = [
+  ];
+  imports = [
+    ../../profiles/common/configuration.nix
+    ../../modules/opinionatedDisk.nix
+
+    ./system.nix
+    ./hw.nix
+    ./pkg.nix
+    ./boot.nix
+  ];
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix
new file mode 100644
index 0000000..4714d6e
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/hw.nix
@@ -0,0 +1,31 @@
+{ ... }:
+
+let
+  stage1Modules =  [
+    "aesni_intel"
+    "kvm-intel"
+    "aes_x86_64"
+
+    "virtio_balloon"
+    "virtio_scsi"
+    "virtio_net"
+    "virtio_pci"
+    "virtio_ring"
+    "virtio"
+    "scsi_mod"
+  ];
+
+in
+{
+  # TASK: new device
+  hardware.opinionatedDisk = {
+    enable = true;
+    encrypted = false;
+    diskId = "ata-Crucial_CT750MX300SSD1_16161311C7A6";
+  };
+
+  boot.initrd.availableKernelModules = stage1Modules;
+  boot.initrd.kernelModules = stage1Modules;
+  boot.extraModprobeConfig = ''
+  '';
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix
new file mode 100644
index 0000000..68784f6
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/pkg.nix
@@ -0,0 +1,53 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+
+{
+  nixpkgs.config.packageOverrides = pkgs: with pkgs; {
+    nixPath = (import ../../../default.nix { versionsPath = ./versions.nix; }).nixPath;
+  };
+  home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { inherit pkgs; };
+
+  nix.buildMachines = [
+    { hostName = "localhost";
+      system = "x86_64-linux";
+      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
+      maxJobs = 4;
+    }
+  ];
+
+  # services.hydra = {
+  #   enable = false;
+  #   hydraURL = "http://localhost:3000"; # externally visible URL
+  #   notificationSender = "hydra@${config.networking.hostName}.stefanjunker.de"; # e-mail of hydra service
+  #   # a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+  #   buildMachinesFiles = [];
+  #   # you will probably also want, otherwise *everything* will be built from scratch
+  #   useSubstitutes = true;
+  # };
+
+  # services.gitlab-runner = {
+  #   enable = false;
+
+  #   extraPackages = with pkgs; [
+  #     bash
+  #     gitlab-runner
+  #     nix
+  #     gitFull
+  #     git-crypt
+  #   ];
+
+  #   concurrent = 2;
+  #   checkInterval = 0;
+  #   services = {
+  #     nixRunner = {
+  #       executor = "shell";
+  #       runUntagged = true;
+  #       registrationConfigFile = "/etc/secrets/gitlab-runner/nix-runner.registration";
+  #       tagList = [ "nix" ];
+  #     };
+  #   };
+  # };
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix
new file mode 100644
index 0000000..a74e612
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/system.nix
@@ -0,0 +1,93 @@
+{ pkgs
+, lib
+, config
+, ... }:
+
+let
+  keys = import ../../../variables/keys.nix;
+
+in {
+  # TASK: new device
+  networking.hostName = "srv0"; # Define your hostname.
+  # networking.domain =  "home-ch.stefanjunker.de";
+
+  networking.firewall.enable = true;
+  networking.firewall.allowedTCPPorts = [
+    # iperf3
+    5201
+  ];
+  networking.firewall.logRefusedConnections = false;
+
+  networking.usePredictableInterfaceNames = false;
+  networking.dhcpcd = {
+    enable = true;
+    persistent = true;
+  };
+
+  networking.interfaces.eth0 = {
+    useDHCP = true;
+    # ipv6.addresses = [
+    #   { address = "2a02:c207:3003:2387::1"; prefixLength = 64; }
+    # ];
+  };
+
+  # networking.defaultGateway6 = {
+  #   address = "fe80::1";
+  #   interface = "eth0";
+  # };
+
+  networking.nat = {
+    enable = true;
+    internalInterfaces = [ "ve-+" ];
+    externalInterface = "eth0";
+  };
+
+  # Kubernetes
+  # services.kubernetes.roles = ["master" "node"];
+
+  # virtualization
+  virtualisation = {
+    docker.enable = true;
+  };
+
+  nix.gc = {
+    automatic = true;
+  };
+
+  networking.useHostResolvConf = true;
+
+  containers = {
+    webserver = import ../../containers/webserver.nix {
+      hostAddress = "192.168.100.12";
+      localAddress = "192.168.100.13";
+
+      httpsPort = 443;
+    };
+
+    syncthing = import ../../containers/syncthing.nix {
+      hostAddress = "192.168.100.14";
+      localAddress = "192.168.100.15";
+
+      syncthingPort = 22000;
+    };
+
+    backup = import ../../containers/backup.nix {
+      inherit config;
+      hostAddress = "192.168.100.16";
+      localAddress = "192.168.100.17";
+      subvolumes = [
+        "webserver"
+        "backup"
+        "syncthing"
+      ];
+    };
+  };
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "20.03"; # Did you read the comment?
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix
new file mode 100644
index 0000000..519781a
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.nix
@@ -0,0 +1,37 @@
+let
+  nixpkgs = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.09";
+    rev = "51aaa3fa1b69559456f9bd4968bd5b179a784f67";
+  };
+in
+
+{
+  inherit nixpkgs;
+  "channels-nixos-stable" = nixpkgs;
+  "channels-nixos-20.03" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.03";
+    rev = "ff6fda61600cc60404bab5cb6b18b8636785b7bc";
+  };
+  "channels-nixos-19.09" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-19.09";
+    rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1";
+  };
+  "channels-nixos-unstable" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-unstable";
+    rev = "24c9b05ac53e422f1af81a156f1fd58499eb27fb";
+  };
+  "nixpkgs-master" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "master";
+    rev = "9b3e35d991ea6a43f256069dcb2e006006730d05";
+  };
+  "home-manager-module" = {
+    url = "https://github.com/nix-community/home-manager";
+    ref = "release-20.09";
+    rev = "7339784e07217ed0232e08d1ea33b610c94657d8";
+  };
+}
diff --git a/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix
new file mode 100644
index 0000000..a19cc09
--- /dev/null
+++ b/nix/os/devices/srv0.home-ch.stefanjunker.de/versions.tmpl.nix
@@ -0,0 +1,37 @@
+let
+  nixpkgs = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.09";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+in
+
+{
+  inherit nixpkgs;
+  "channels-nixos-stable" = nixpkgs;
+  "channels-nixos-20.03" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-20.03";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "channels-nixos-19.09" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-19.09";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "channels-nixos-unstable" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-unstable";
+    rev = "<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "nixpkgs-master" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "master";
+    rev = "<% git ls-remote https://github.com/NixOS/nixpkgs.git master | head -n1 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+  "home-manager-module" = {
+    url = "https://github.com/nix-community/home-manager";
+    ref = "release-20.09";
+    rev = "<% git ls-remote https://github.com/nix-community/home-manager.git release-20.09 | awk '{ print $1 }' | tr -d '\n' -%>";
+  };
+}
diff --git a/nix/os/devices/vmd32387.contaboserver.net/system.nix b/nix/os/devices/vmd32387.contaboserver.net/system.nix
index 2944e09..c25022a 100644
--- a/nix/os/devices/vmd32387.contaboserver.net/system.nix
+++ b/nix/os/devices/vmd32387.contaboserver.net/system.nix
@@ -114,24 +114,14 @@ in {
       sievePort = 4190;
     };
 
-    webserver = import ../../containers/webserver.nix {
-      hostAddress = "192.168.100.12";
-      localAddress = "192.168.100.13";
-
-      httpsPort = 443;
-    };
-
-    syncthing = import ../../containers/syncthing.nix {
-      hostAddress = "192.168.100.14";
-      localAddress = "192.168.100.15";
-
-      syncthingPort = 22000;
-    };
-
     backup = import ../../containers/backup.nix {
       inherit config;
       hostAddress = "192.168.100.16";
       localAddress = "192.168.100.17";
+      subvolumes = [
+        "mailserver"
+        "backup"
+      ];
     };
   };
 
diff --git a/nix/variables/passwords.crypt.nix b/nix/variables/passwords.crypt.nix
index 92f89d2..98713c6 100644
Binary files a/nix/variables/passwords.crypt.nix and b/nix/variables/passwords.crypt.nix differ
diff --git a/services/home-ch/router-wan.lan/Justfile b/services/home-ch/router-wan.lan/Justfile
index 8792f32..3715bfa 100644
--- a/services/home-ch/router-wan.lan/Justfile
+++ b/services/home-ch/router-wan.lan/Justfile
@@ -3,7 +3,10 @@ _run_ssh_cmd cmd:
 
 post-setup:
 	just -v _run_ssh_cmd "opkg update"
-	just -v _run_ssh_cmd "opkg install luci-ssl"
+	just -v _run_ssh_cmd "opkg install luci-ssl luci-app-ddns"
 	just -v _run_ssh_cmd "opkg install luci-app-samba samba36-server"
-	just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils"
+	just -v _run_ssh_cmd "opkg install block-mount blockd kmod-fs-vfat kmod-usb-storage usbutils kmod-usb-storage-uas kmod-fs-btrfs btrfs-progs"
+	# multiuser SFTP
+	just -v _run_ssh_cmd "opkg install openssh-server openssh-sftp-server"
+	just -v _run_ssh_cmd "opkg install sudo coreutils-readlink"
 	just -v _run_ssh_cmd "/etc/init.d/uhttpd restart"