diff --git a/nodes/backup-kunsi.toml b/nodes/backup-kunsi.toml
new file mode 100644
index 0000000..276aa0a
--- /dev/null
+++ b/nodes/backup-kunsi.toml
@@ -0,0 +1,34 @@
+hostname = "2001:67c:b54:1::f"
+bundles = ["backup-server", "dm-crypt", "zfs"]
+groups = ["debian-bookworm"]
+
+[metadata]
+nameservers = ["2001:4860:4860::8888"]
+
+[metadata.apt.unattended-upgrades]
+# requires manual apply to unlock disks
+reboot_enabled = false
+
+[metadata.interfaces.ens18]
+ips = ["2001:67c:b54:1::f/64"]
+gateway6 = "2001:67c:b54:1::1"
+
+[metadata.backups]
+# this is the backup server
+exclude_from_backups = true
+
+[metadata.backup-server.zpool_create_options]
+ashift = 12
+
+[[metadata.backup-server.encrypted-devices]]
+"/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1-part1" = "!bwpass:bw/backup-kunsi/ata-ST18000NM0092-3CX103_ZVV06SLR-part1"
+"/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi2-part1" = "!bwpass:bw/backup-kunsi/ata-ST18000NM0092-3CX103_ZVV0686W-part1"
+"/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi3-part1" = "!bwpass:bw/backup-kunsi/ata-ST18000NM0092-3CX103_ZVV06JV7-part1"
+
+[[metadata.backup-server.encrypted-devices]]
+"/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1-part2" = "!bwpass:bw/backup-kunsi/ata-ST18000NM0092-3CX103_ZVV06SLR-part2"
+"/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi2-part2" = "!bwpass:bw/backup-kunsi/ata-ST18000NM0092-3CX103_ZVV0686W-part2"
+"/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi3-part2" = "!bwpass:bw/backup-kunsi/ata-ST18000NM0092-3CX103_ZVV06JV7-part2"
+
+[metadata.zfs]
+scrub_when = "Wed 08:00 Europe/Berlin"