diff --git a/group_vars/backup.yml b/group_vars/backup.yml
new file mode 100644
index 0000000..ec4ea73
--- /dev/null
+++ b/group_vars/backup.yml
@@ -0,0 +1,3 @@
+---
+firewall_in:
+  - {proto: tcp, port: 22, from: [172.20.20.0/22]}
diff --git a/host_vars/backup02.home.foo.sh.yml b/host_vars/backup02.home.foo.sh.yml
new file mode 100644
index 0000000..9f0641c
--- /dev/null
+++ b/host_vars/backup02.home.foo.sh.yml
@@ -0,0 +1,10 @@
+---
+vmhost: vmhost02.home.foo.sh
+network_interfaces:
+  - device: vio0
+    vlan: 20
+    mac: 52:54:00:ac:dc:50
+datadisks:
+  - 1000
+passthrough_devices:
+  - "09:04.0"
diff --git a/hosts b/hosts
index 0b13740..272b86e 100644
--- a/hosts
+++ b/hosts
@@ -2,6 +2,9 @@
 adm01.home.foo.sh
 adm02.home.foo.sh
 
+[backup]
+backup02.home.foo.sh
+
 [collab]
 collab01.home.foo.sh
 
@@ -92,6 +95,7 @@ ldap
 collab
 
 [openbsd:children]
+backup
 dnagw
 fsolgw
 log
diff --git a/playbooks/backup.yml b/playbooks/backup.yml
new file mode 100644
index 0000000..a851647
--- /dev/null
+++ b/playbooks/backup.yml
@@ -0,0 +1,24 @@
+---
+- import_playbook: "include/deploy-kvm-guest.yml myhosts=backup"
+
+- name: configure instance
+  hosts: backup
+  user: root
+  gather_facts: true
+
+  pre_tasks:
+    - name: mount /export
+      mount:
+        name: /export
+        src: /dev/sd1a
+        fstype: ffs
+        opts: rw,softdep,noatime
+        passno: "1"
+        dump: "2"
+        state: mounted
+
+  vars_files:
+    - "{{ ansible_private }}/vars.yml"
+
+  roles:
+    - base