diff --git a/bin/backup-home.sh b/bin/backup-home.sh
new file mode 100644
index 0000000..8b528e9
--- /dev/null
+++ b/bin/backup-home.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+# Tar my dotfiles and configs to the NAS. Excludes anything gitignored-looking.
+set -eu
+dest="/mnt/nas/backup/$(hostname)-$(date +%F).tgz"
+tar --exclude='*.env' --exclude='*.pem' --exclude='*.p12' \
+    -czf "$dest" "$HOME/.config" "$HOME/dotfiles" 2>/dev/null || true
+echo "wrote $dest"