diff --git a/hosts/backup-4/restic-server.nix b/hosts/backup-4/restic-server.nix
index 97fcc47..86a4794 100644
--- a/hosts/backup-4/restic-server.nix
+++ b/hosts/backup-4/restic-server.nix
@@ -8,6 +8,15 @@
     listenAddress = "[::1]:43242";
   };
 
+  # restic rest server does not support --htpasswd-file in the current version of nixpkgs
+  # until then we copy the secrets to the common location
+  age.secrets.restic-server-magenta-htpasswd = {
+    path = "/mnt/clerie-backup/magenta/.htpasswd";
+    symlink = false;
+    owner = "restic";
+    group = "restic";
+  };
+
   services.nginx.virtualHosts."magenta.backup.clerie.de" = {
     enableACME = true;
     forceSSL = true;
diff --git a/hosts/backup-4/secrets/restic-server-magenta-htpasswd.age b/hosts/backup-4/secrets/restic-server-magenta-htpasswd.age
new file mode 100644
index 0000000..00241d9
Binary files /dev/null and b/hosts/backup-4/secrets/restic-server-magenta-htpasswd.age differ
diff --git a/hosts/backup-4/ssh.pub b/hosts/backup-4/ssh.pub
new file mode 100644
index 0000000..d564468
--- /dev/null
+++ b/hosts/backup-4/ssh.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUaAo7yYjuVpWadxPqrUGrZWwLNltvc+PfOT8z36Eip