diff --git a/app/backup b/app/backup
new file mode 100755
index 0000000..b0e8339
--- /dev/null
+++ b/app/backup
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# === CONFIG ===
+REPO="/backups/borgrepo"
+HOSTS_FILE="host_vars/hosts"
+ARCHIVE_NAME="backup-$(date +%Y-%m-%d)"
+
+# === BUILD SOURCE LIST ===
+SOURCES=()
+
+while read -r host; do
+    [[ -z "$host" || "$host" =~ ^# ]] && continue
+    SOURCES+=("${host}:/")
+done < "$HOSTS_FILE"
+
+echo "Backing up hosts:"
+printf ' - %s\n' "${SOURCES[@]}"
+
+# === CREATE BACKUP (ONLY current*) ===
+borg create \
+    "$REPO::$ARCHIVE_NAME" \
+    "${SOURCES[@]}" \
+    --patterns-from <(cat <<'EOF'
+R sh:**
++ sh:**/current*
+- sh:**
+EOF
+) \
+    --stats \
+    --compression lz4
+
+# === RETENTION POLICY ===
+echo "Applying retention policy..."
+
+borg prune \
+    "$REPO" \
+    --keep-daily=7 \
+    --keep-weekly=8 \
+    --prefix "backup-" \
+    --stats
+
+echo "Done: $ARCHIVE_NAME"