diff --git a/.gitignore b/.gitignore
index f573a42..ec6ca16 100644
--- a/.gitignore
+++ b/.gitignore
@@ -82,3 +82,12 @@ Temporary Items
 # .nfs files are created when an open file is removed but is still being accessed
 .nfs*
 
+# Keys & Secrets
+*.key
+*.asc
+*.txt
+
+# Backups
+*.tar.gz
+*.tar.gz.enc
+*.tar.gz.age
diff --git a/README.md b/README.md
index 323e962..9458379 100644
--- a/README.md
+++ b/README.md
@@ -1,18 +1,21 @@
 # Michael's Homelab
 
-## Hosts & Services
+## Hosts 
 
-### Cuddlefish
+| Host | OS   | Services |
+| :--- | :--- | :------- |
+| Cuddlefish | ![CentOS](https://img.shields.io/badge/centos%207-002260?style=for-the-badge&logo=centos&logoColor=F0F0F0) | Gitea |
+| Rocktiplex | ![Rocky Linux](https://img.shields.io/badge/-Rocky%20Linux%209-%2310B981?style=for-the-badge&logo=rockylinux&logoColor=white) | Fathom |
+| Cloud8 | ![Rocky Linux](https://img.shields.io/badge/-Rocky%20Linux%209-%2310B981?style=for-the-badge&logo=rockylinux&logoColor=white) | NextCloud |
 
-![CentOS](https://img.shields.io/badge/centos%207-002260?style=for-the-badge&logo=centos&logoColor=F0F0F0)
+## SELinux Notes
 
-- `git.michaellisano.com`
+Docker volumes violate some SELinux policies. Use `setenforce 0` to disable it temporarily, or make the following permanent change to `/etc/sysconfig/selinux`:
 
-### Rocktiplex
-
-![Rocky Linux](https://img.shields.io/badge/-Rocky%20Linux%209-%2310B981?style=for-the-badge&logo=rockylinux&logoColor=white)
-
-- `analytics.michaellisano.com`
+```bash
+# SELINUX=enforcing
+SELINUX=permissive
+```
 
 ## Dockerized Cloudflared Notes
 
@@ -34,3 +37,23 @@ Then in this case the name of the target service is `gitea-server`, and (per Doc
 https://git.michaellisano.com -> http://gitea-server:3000
 ```
 
+## Backup Decryption Notes
+
+Everything is encrypted with [age](https://github.com/FiloSottile/age).
+
+All keys are generated using age-keygen and stored in a text file, e.g.
+
+**backup-key.txt**
+
+```
+# created: 2023-06-24T18:01:36-07:00
+# public key: age12345...
+AGE-SECRET-KEY-xyz123...
+```
+
+Decrypting a file:
+
+```
+age -d -i backup-key.txt -o NAME.tar.gz NAME.tar.gz.enc
+```
+
diff --git a/backup/README.md b/backup/README.md
new file mode 100644
index 0000000..73b489f
--- /dev/null
+++ b/backup/README.md
@@ -0,0 +1,30 @@
+# Generic Backup Host
+
+## Crontab
+
+Runs on the second of every month.
+
+```
+0 0 2 * * cd /home/USER/backups && bash prune.sh
+```
+
+## Filename Pattern
+
+Container volume backups are of the format:
+
+```
+gitea-data-2023-06-17_050002.tar.gz.enc
+^          ^                ^
+|          |                Backups are encrypted tarballs
+|          |
+|          ISO Datetime separated by _
+|
+Container volume name (*-data)
+```
+
+Regex to match backups that are *not* from the first of every month, using the above format:
+
+```
+[0-9A-Za-z]+-data-[0-9]{4}-[0-9]{2}-([^0][0-9]|[0-9][^1])_.*
+```
+
diff --git a/backup/prune.sh b/backup/prune.sh
new file mode 100644
index 0000000..5bdff32
--- /dev/null
+++ b/backup/prune.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/bash
+
+# Prunes container data folders monthly on backup host.
+# Removes all items but the backup from the first day of the month.
+# Should run on the first day of every month - since it doesn't remove the backup
+# from that time, it doesn't matter what time it's run
+
+for item in *; do
+    if [[ "$item" =~ [0-9A-Za-z]+-data-[0-9]{4}-[0-9]{2}-([^0][0-9]|[0-9][^1])_.* ]]; then
+        echo "Removing $item"
+        rm -f $item
+    fi
+done
+
diff --git a/cuddlefish/backup b/cuddlefish/backup
index ea56d23..db28390 100755
--- a/cuddlefish/backup
+++ b/cuddlefish/backup
@@ -1,11 +1,11 @@
 #!/bin/bash
-
 # NOTE: DEPENDING ON PERMISSIONING, YOU MAY NEED TO RUN THIS SCRIPT USING SUDO
 
 source .env
 
 DATESTRING=$(date +"%Y-%m-%d_%H%M%S" | tr '[:upper:]' '[:lower:]' | tr ' ' '_')
 ARCHIVE="gitea-data-${DATESTRING}.tar.gz"
-tar -czvf $ARCHIVE gitea-data/
-scp -i $BACKUP_KEYPATH -P $BACKUP_SSH_PORT $ARCHIVE $BACKUP_HOST:~/backups/
-rm $ARCHIVE && echo Removed $ARCHIVE.
+tar -czvf $ARCHIVE gitea-data/ && \
+	age -e -r age1grpe9c934q09933g7mxne03z7k6e572tjcqxdkne6rwyfht2saeq90sf3f -o $ARCHIVE.enc $ARCHIVE && \
+	scp -i $BACKUP_KEYPATH -P $BACKUP_SSH_PORT $ARCHIVE.enc $BACKUP_HOST:~/backups/
+rm -f $ARCHIVE $ARCHIVE.age && echo Removed $ARCHIVE, $ARCHIVE.enc.
diff --git a/cuddlefish/docker-compose.yaml b/cuddlefish/docker-compose.yaml
index bdc4836..fb0ba42 100644
--- a/cuddlefish/docker-compose.yaml
+++ b/cuddlefish/docker-compose.yaml
@@ -6,6 +6,10 @@ networks:
 
 services:
 
+  # ========================================
+  #          GIT.MICHAELLISANO.COM
+  # ========================================
+
   gitea-server:
     image: gitea/gitea:1.19.3
     container_name: gitea
@@ -33,3 +37,4 @@ services:
     networks:
       - gitea
 
+