diff --git a/hosts/ao/default.nix b/hosts/ao/default.nix
index 0ca240a0..d95f4a70 100644
--- a/hosts/ao/default.nix
+++ b/hosts/ao/default.nix
@@ -9,6 +9,7 @@ with lib.my;
     ../home.nix
     ./hardware-configuration.nix
 
+    ./modules/backup.nix
     ./modules/gitea.nix
     ./modules/bitwarden.nix
   ];
diff --git a/hosts/ao/modules/backup.nix b/hosts/ao/modules/backup.nix
new file mode 100644
index 00000000..de4d1359
--- /dev/null
+++ b/hosts/ao/modules/backup.nix
@@ -0,0 +1,50 @@
+{ config, lib, pkgs, ... }:
+
+{
+  services.bitwarden_rs.backupDir = "/backups/bitwarden_rs";
+  services.gitea.dump.enable = true;
+  services.gitea.dump.backupDir = "/backups/gitea";
+  system.activationScripts.createBackupDir = ''
+    mkdir -m 750 -p "${config.services.bitwarden_rs.backupDir}" || true
+    mkdir -m 750 -p "${config.services.gitea.dump.backupDir}" || true
+    chown bitwarden_rs:bitwarden_rs "${config.services.bitwarden_rs.backupDir}"
+    chown git:gitea "${config.services.gitea.dump.backupDir}"
+  '';
+
+  # systemd = {
+  #   services.backups = {
+  #     description = "Backup /backups to NAS";
+  #     wants = [ "usr-drive.mount" ];
+  #     path  = [ pkgs.rsync ];
+  #     environment = {
+  #       SRC_DIR  = "/backups";
+  #       DEST_DIR = "/usr/drive";
+  #     };
+  #     script = ''
+  #       if [[ -d "$1" && -d "$2" ]]; then
+  #         echo "---- BACKUPING UP $1 TO $2 ----"
+  #         rsync -rlptPJ --delete --delete-after \
+  #             --chmod=go= \
+  #             --chown=hlissner:users \
+  #             --exclude=lost+found/ \
+  #             --exclude=@eaDir/ \
+  #             --include=.git/ \
+  #             --filter=':- .gitignore' \
+  #             --filter=':- $XDG_CONFIG_HOME/git/ignore' \
+  #             "$SRC_DIR/" "$DEST_DIR"
+  #       fi
+  #     '';
+  #     serviceConfig = {
+  #       Type = "oneshot";
+  #       Nice = 19;
+  #       IOSchedulingClass = "idle";
+  #     };
+  #   };
+  #   timers.backups = {
+  #     wantedBy = [ "timers.target" ];
+  #     partOf = [ "backups.service" ];
+  #     timerConfig.OnCalendar = "*-*-* 03:00:00";
+  #     timerConfig.Persistent = true;
+  #   };
+  # };
+}
diff --git a/modules/services/bitwarden.nix b/modules/services/bitwarden.nix
index 1de1ac26..33da4307 100644
--- a/modules/services/bitwarden.nix
+++ b/modules/services/bitwarden.nix
@@ -9,10 +9,7 @@ in {
   };
 
   config = mkIf cfg.enable {
-    services.bitwarden_rs = {
-      enable = true;
-      backupDir = "/run/backups/bitwarden_rs";
-    };
+    services.bitwarden_rs.enable = true;
 
     user.extraGroups = [ "bitwarden_rs" ];
 
@@ -22,13 +19,5 @@ in {
       port = 80,443,8002
       maxretry = 5
     '';
-
-    # HACK services.bitwarden_rs errors about permissions trying to create
-    #      backupDir in /run/backups, so we do it for it.
-    system.activationScripts.bitwardenCreateDirs = ''
-      DIR="${config.services.bitwarden_rs.backupDir}"
-      mkdir -m 750 -p "$DIR" || true
-      chown bitwarden_rs:bitwarden_rs "$DIR"
-    '';
   };
 }
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index 287b82ee..31c48ed2 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -45,11 +45,7 @@ in {
         service.ENABLE_BASIC_AUTHENTICATION = false;
       };
 
-      dump = {
-        enable = true;
-        interval = "daily";
-        backupDir = "/run/backups/gitea";
-      };
+      dump.interval = "daily";
     };
 
     services.fail2ban.jails.gitea = ''