diff --git a/host_files/btrbk/narwhal/btrbk.conf b/host_files/btrbk/narwhal/btrbk.conf
index e69de29..3909514 100644
--- a/host_files/btrbk/narwhal/btrbk.conf
+++ b/host_files/btrbk/narwhal/btrbk.conf
@@ -0,0 +1,32 @@
+transaction_log   /var/log/btrbk.log
+lockfile          /run/lock/btrbk.lock
+timestamp_format  long
+snapshot_create   onchange
+
+snapshot_preserve      24h 7d 0w 0m 0y
+snapshot_preserve_min  latest
+target_preserve        0h 14d 6w 4m 1y
+target_preserve_min    latest
+archive_preserve       0h 1d 1w 1m 1y
+archive_preserve_min   latest
+
+incremental yes
+ssh_identity /var/lib/btrbk/.ssh/id_ed25519
+ssh_user btrbk
+backend btrfs-progs-doas
+
+volume /mnt/btr_pool
+  snapshot_dir  btrbk_snapshots
+  target        ssh://suricata/mnt/btr_backup/narwhal
+  subvolume backups
+  subvolume books
+  subvolume certs
+  subvolume data
+  subvolume docker_volumes
+  subvolume home
+  subvolume home-data
+  subvolume http
+  subvolume music
+  subvolume secrets
+  subvolume transmission
+  subvolume videos
diff --git a/host_files/btrbk/suricata/btrbk.conf b/host_files/btrbk/suricata/btrbk.conf
index 64c23c4..b71e4b7 100644
--- a/host_files/btrbk/suricata/btrbk.conf
+++ b/host_files/btrbk/suricata/btrbk.conf
@@ -1,9 +1,21 @@
-timestamp_format        long
-snapshot_preserve_min   18h
-snapshot_preserve       48h
+transaction_log   /var/log/btrbk.log
+lockfile          /run/lock/btrbk.lock
+timestamp_format  long
+snapshot_create   onchange
 
-transaction_log /var/log/btrbk.log
+snapshot_preserve      24h 7d 0w 0m 0y
+snapshot_preserve_min  latest
+target_preserve        0h 14d 6w 4m 1y
+target_preserve_min    latest
+archive_preserve       0h 1d 1w 1m 1y
+archive_preserve_min   latest
+
+incremental yes
+ssh_identity /var/lib/btrbk/.ssh/id_ed25519
+ssh_user btrbk
+backend btrfs-progs-doas
 
 volume /mnt/btr_pool
-  snapshot_dir btrbk_snapshots
+  snapshot_dir  btrbk_snapshots
   subvolume home
+  subvolume rancher_config