diff --git a/external/Makefile b/external/Makefile
index 873edec6..c1fa2905 100644
--- a/external/Makefile
+++ b/external/Makefile
@@ -21,3 +21,6 @@ plan: .terraform.lock.hcl
 
 apply: .terraform.lock.hcl namespaces
 	terraform apply -auto-approve
+
+format:
+	terraform fmt -recursive .
diff --git a/external/main.tf b/external/main.tf
index 1fb5ab27..8cdad76d 100644
--- a/external/main.tf
+++ b/external/main.tf
@@ -17,3 +17,8 @@ module "ntfy" {
   source = "./modules/ntfy"
   auth   = var.ntfy
 }
+
+module "backup" {
+  source        = "./modules/backup"
+  backup_bucket = var.backup_bucket
+}
diff --git a/external/modules/backup/main.tf b/external/modules/backup/main.tf
new file mode 100644
index 00000000..dd6a877b
--- /dev/null
+++ b/external/modules/backup/main.tf
@@ -0,0 +1,16 @@
+resource "kubernetes_secret" "velero_credentials" {
+  metadata {
+    name      = "velero-credentials"
+    namespace = "velero"
+  }
+
+  data = {
+    cloud = <<EOF
+      %{for bucket in var.backup_buckets~}
+      [${bucket.name}]
+      aws_access_key_id=${bucket.access_key_id}
+      aws_secret_access_key=${bucket.secret_access_key}
+      %{endfor~}
+    EOF
+  }
+}
diff --git a/external/modules/backup/variables.tf b/external/modules/backup/variables.tf
new file mode 100644
index 00000000..e8fadec5
--- /dev/null
+++ b/external/modules/backup/variables.tf
@@ -0,0 +1,10 @@
+variable "backup_buckets" {
+  type = list(object({
+    name              = string
+    url               = string
+    bucket            = string
+    region            = string
+    access_key_id     = string
+    secret_access_key = string
+  }))
+}
diff --git a/external/modules/backup/versions.tf b/external/modules/backup/versions.tf
new file mode 100644
index 00000000..bdfd2cf4
--- /dev/null
+++ b/external/modules/backup/versions.tf
@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    kubernetes = {
+      source  = "hashicorp/kubernetes"
+      version = "~> 2.9.0"
+    }
+  }
+}
diff --git a/external/namespaces.yml b/external/namespaces.yml
index 7e1767c2..ff4d11b9 100644
--- a/external/namespaces.yml
+++ b/external/namespaces.yml
@@ -12,4 +12,5 @@
         - external-dns
         - global-secrets
         - k8up-operator
+        - velero
         - zerotier
diff --git a/external/variables.tf b/external/variables.tf
index 147df0ff..30c99f42 100644
--- a/external/variables.tf
+++ b/external/variables.tf
@@ -24,3 +24,14 @@ variable "ntfy" {
 
   sensitive = true
 }
+
+variable "backup_bucket" {
+  type = object({
+    name              = string
+    url               = string
+    bucket            = string
+    region            = string
+    access_key_id     = string
+    secret_access_key = string
+  })
+}
diff --git a/system/velero/Chart.yaml b/system/velero/Chart.yaml
new file mode 100644
index 00000000..5fb35a37
--- /dev/null
+++ b/system/velero/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: velero
+version: 0.0.0
+dependencies:
+  - name: velero
+    version: 2.31.8
+    repository: https://vmware-tanzu.github.io/helm-charts
diff --git a/system/velero/values.yaml b/system/velero/values.yaml
new file mode 100644
index 00000000..c2f7218b
--- /dev/null
+++ b/system/velero/values.yaml
@@ -0,0 +1,35 @@
+velero:
+  initContainers:
+    - name: velero-plugin-for-aws
+      image: velero/velero-plugin-for-aws:v1.5.1
+      imagePullPolicy: IfNotPresent
+      volumeMounts:
+        - mountPath: /target
+          name: plugins
+  configuration:
+    provider: aws
+    # TODO support multiple locations
+    backupStorageLocation:
+      bucket: homelab-backup
+      config:
+        region: minio
+        s3ForcePathStyle: 'true'
+        s3Url: http://192.168.1.24:9000
+        profile: onsite
+    defaultVolumesToRestic: true
+  credentials:
+    useSecret: true
+    existingSecret: velero-credentials
+  schedules:
+    onsite:
+      schedule: "*/2 * * * *"
+      storageLocation: default
+      template:
+        ttl: "240h"
+    # TODO support multiple locations
+    # offsite:
+    #   schedule: "*/2 * * * *"
+    #   storageLocation: offsite
+    #   template:
+    #     ttl: "240h"
+  deployRestic: true