diff --git a/CHANGELOG.md b/CHANGELOG.md
index de0f58c..b53cc84 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,8 @@
 - Use `# length=x` comments to generate passwords with `pwgen` and drop `KEY`/`PASSWORD` logic ([#68](https://git.autonomic.zone/coop-cloud/abra/issues/68))
 - Global `--skip-update` / `--skip-check` options to make things quicker,
 		[37e8b00](https://git.autonomic.zone/coop-cloud/abra/commit/37e8b00)
+- `app backup` command; requires per-app definition -- see
+		[#70](https://git.autonomic.zone/coop-cloud/abra/issues/70)
 
 # abra 0.4.1 (2020-12-24)
 
diff --git a/abra b/abra
index f4296c9..f0af2a4 100755
--- a/abra
+++ b/abra
@@ -12,20 +12,21 @@ DOC="
 The cooperative cloud utility belt 🎩🐇
 
 Usage:
-  abra [options] app new [--server=<server>] [--domain=<domain>] [--app-name=<app_name>] [--pass] [--secrets] <type>
   abra [options] app (list|ls) [--status] [--server=<server>]
-  abra [options] app <app> deploy [--skip-check]
-  abra [options] app <app> undeploy
-  abra [options] app <app> config
-  abra [options] app <app> (delete|rm) [--force]
-  abra [options] app <app> logs [<service>]
-  abra [options] app <app> cp <src> <dst>
+  abra [options] app new [--server=<server>] [--domain=<domain>] [--app-name=<app_name>] [--pass] [--secrets] <type>
+  abra [options] app <app> backup (<service>|--all)
+  abra [options] app <app> deploy
   abra [options] app <app> check
+  abra [options] app <app> config
+  abra [options] app <app> cp <src> <dst>
+  abra [options] app <app> logs [<service>]
   abra [options] app <app> ps
+  abra [options] app <app> restore (<service>|--all)
+  abra [options] app <app> (rm|delete) [--force]
   abra [options] app <app> run [--no-tty] [--user=<user>] <service> <args>...
   abra [options] app <app> secret generate (<secret> <version>|--all) [<cmd>] [--pass]
   abra [options] app <app> secret insert <secret> <version> <data> [--pass]
-  abra [options] app <app> secret (delete|rm) (<secret>|--all) [--pass] [--force]
+  abra [options] app <app> secret (rm|delete) (<secret>|--all) [--pass] [--force]
   abra [options] app <app> <command> [<args>...]
   abra [options] server add <host> [<user>] [<port>]
   abra [options] server (list|ls)
@@ -145,98 +146,100 @@ eval "var_$1+=($value)"; else eval "var_$1=$value"; fi; return 0; fi; done
 return 1; }; stdout() { printf -- "cat <<'EOM'\n%s\nEOM\n" "$1"; }; stderr() {
 printf -- "cat <<'EOM' >&2\n%s\nEOM\n" "$1"; }; error() {
 [[ -n $1 ]] && stderr "$1"; stderr "$usage"; _return 1; }; _return() {
-printf -- "exit %d\n" "$1"; exit "$1"; }; set -e; trimmed_doc=${DOC:1:1545}
-usage=${DOC:40:1169}; digest=51a25
-shorts=(-s -U -h -e '' '' '' '' '' '' -C '' '' '' '')
-longs=(--stack --skip-update --help --env --server --domain --app-name --pass --secrets --status --skip-check --force --no-tty --user --all)
-argcounts=(1 0 0 1 1 1 1 0 0 0 0 0 0 1 0); node_0(){ value __stack 0; }
-node_1(){ switch __skip_update 1; }; node_2(){ switch __help 2; }; node_3(){
-value __env 3; }; node_4(){ value __server 4; }; node_5(){ value __domain 5; }
-node_6(){ value __app_name 6; }; node_7(){ switch __pass 7; }; node_8(){
-switch __secrets 8; }; node_9(){ switch __status 9; }; node_10(){
-switch __skip_check 10; }; node_11(){ switch __force 11; }; node_12(){
-switch __no_tty 12; }; node_13(){ value __user 13; }; node_14(){ switch __all 14
-}; node_15(){ value _type_ a; }; node_16(){ value _app_ a; }; node_17(){
-value _service_ a; }; node_18(){ value _src_ a; }; node_19(){ value _dst_ a; }
-node_20(){ value _args_ a true; }; node_21(){ value _secret_ a; }; node_22(){
-value _version_ a; }; node_23(){ value _cmd_ a; }; node_24(){ value _data_ a; }
-node_25(){ value _command_ a; }; node_26(){ value _host_ a; }; node_27(){
-value _user_ a; }; node_28(){ value _port_ a; }; node_29(){
+printf -- "exit %d\n" "$1"; exit "$1"; }; set -e; trimmed_doc=${DOC:1:1599}
+usage=${DOC:40:1223}; digest=70cdc
+shorts=(-U -e -s -h -C '' '' '' '' '' '' '' '' '' '')
+longs=(--skip-update --env --stack --help --skip-check --status --server --domain --app-name --pass --secrets --all --force --no-tty --user)
+argcounts=(0 1 1 0 0 0 1 1 1 0 0 0 0 0 1); node_0(){ switch __skip_update 0; }
+node_1(){ value __env 1; }; node_2(){ value __stack 2; }; node_3(){
+switch __help 3; }; node_4(){ switch __skip_check 4; }; node_5(){
+switch __status 5; }; node_6(){ value __server 6; }; node_7(){ value __domain 7
+}; node_8(){ value __app_name 8; }; node_9(){ switch __pass 9; }; node_10(){
+switch __secrets 10; }; node_11(){ switch __all 11; }; node_12(){
+switch __force 12; }; node_13(){ switch __no_tty 13; }; node_14(){
+value __user 14; }; node_15(){ value _type_ a; }; node_16(){ value _app_ a; }
+node_17(){ value _service_ a; }; node_18(){ value _src_ a; }; node_19(){
+value _dst_ a; }; node_20(){ value _args_ a true; }; node_21(){ value _secret_ a
+}; node_22(){ value _version_ a; }; node_23(){ value _cmd_ a; }; node_24(){
+value _data_ a; }; node_25(){ value _command_ a; }; node_26(){ value _host_ a; }
+node_27(){ value _user_ a; }; node_28(){ value _port_ a; }; node_29(){
 value _subcommands_ a true; }; node_30(){ _command app; }; node_31(){
-_command new; }; node_32(){ _command list; }; node_33(){ _command ls; }
-node_34(){ _command deploy; }; node_35(){ _command undeploy; }; node_36(){
-_command config; }; node_37(){ _command delete; }; node_38(){ _command rm; }
-node_39(){ _command logs; }; node_40(){ _command cp; }; node_41(){
-_command check; }; node_42(){ _command ps; }; node_43(){ _command run; }
-node_44(){ _command secret; }; node_45(){ _command generate; }; node_46(){
-_command insert; }; node_47(){ _command server; }; node_48(){ _command add; }
-node_49(){ _command init; }; node_50(){ _command apps; }; node_51(){
-_command upgrade; }; node_52(){ _command version; }; node_53(){ _command help; }
-node_54(){ optional 0 1 2 3; }; node_55(){ optional 54; }; node_56(){ optional 4
-}; node_57(){ optional 5; }; node_58(){ optional 6; }; node_59(){ optional 7; }
-node_60(){ optional 8; }; node_61(){ required 55 30 31 56 57 58 59 60 15; }
-node_62(){ either 32 33; }; node_63(){ required 62; }; node_64(){ optional 9; }
-node_65(){ required 55 30 63 64 56; }; node_66(){ optional 10; }; node_67(){
-required 55 30 16 34 66; }; node_68(){ required 55 30 16 35; }; node_69(){
-required 55 30 16 36; }; node_70(){ either 37 38; }; node_71(){ required 70; }
-node_72(){ optional 11; }; node_73(){ required 55 30 16 71 72; }; node_74(){
-optional 17; }; node_75(){ required 55 30 16 39 74; }; node_76(){
-required 55 30 16 40 18 19; }; node_77(){ required 55 30 16 41; }; node_78(){
-required 55 30 16 42; }; node_79(){ optional 12; }; node_80(){ optional 13; }
-node_81(){ oneormore 20; }; node_82(){ required 55 30 16 43 79 80 17 81; }
-node_83(){ required 21 22; }; node_84(){ either 83 14; }; node_85(){ required 84
-}; node_86(){ optional 23; }; node_87(){ required 55 30 16 44 45 85 86 59; }
-node_88(){ required 55 30 16 44 46 21 22 24 59; }; node_89(){ either 21 14; }
-node_90(){ required 89; }; node_91(){ required 55 30 16 44 71 90 59 72; }
-node_92(){ optional 81; }; node_93(){ required 55 30 16 25 92; }; node_94(){
-optional 27; }; node_95(){ optional 28; }; node_96(){ required 55 47 48 26 94 95
-}; node_97(){ required 55 47 63; }; node_98(){ required 55 47 26 38; }
-node_99(){ required 55 47 26 49; }; node_100(){ required 55 47 26 50 64; }
-node_101(){ required 55 51; }; node_102(){ required 55 52; }; node_103(){
-oneormore 29; }; node_104(){ optional 103; }; node_105(){ required 55 53 104; }
-node_106(){
-either 61 65 67 68 69 73 75 76 77 78 82 87 88 91 93 96 97 98 99 100 101 102 105
-}; node_107(){ required 106; }; cat <<<' docopt_exit() {
-[[ -n $1 ]] && printf "%s\n" "$1" >&2; printf "%s\n" "${DOC:40:1169}" >&2
-exit 1; }'; unset var___stack var___skip_update var___help var___env \
-var___server var___domain var___app_name var___pass var___secrets var___status \
-var___skip_check var___force var___no_tty var___user var___all var__type_ \
-var__app_ var__service_ var__src_ var__dst_ var__args_ var__secret_ \
+_command list; }; node_32(){ _command ls; }; node_33(){ _command new; }
+node_34(){ _command backup; }; node_35(){ _command deploy; }; node_36(){
+_command check; }; node_37(){ _command config; }; node_38(){ _command cp; }
+node_39(){ _command logs; }; node_40(){ _command ps; }; node_41(){
+_command restore; }; node_42(){ _command rm; }; node_43(){ _command delete; }
+node_44(){ _command run; }; node_45(){ _command secret; }; node_46(){
+_command generate; }; node_47(){ _command insert; }; node_48(){ _command server
+}; node_49(){ _command add; }; node_50(){ _command init; }; node_51(){
+_command apps; }; node_52(){ _command upgrade; }; node_53(){ _command version; }
+node_54(){ _command help; }; node_55(){ optional 0 1 2 3 4; }; node_56(){
+optional 55; }; node_57(){ either 31 32; }; node_58(){ required 57; }
+node_59(){ optional 5; }; node_60(){ optional 6; }; node_61(){
+required 56 30 58 59 60; }; node_62(){ optional 7; }; node_63(){ optional 8; }
+node_64(){ optional 9; }; node_65(){ optional 10; }; node_66(){
+required 56 30 33 60 62 63 64 65 15; }; node_67(){ either 17 11; }; node_68(){
+required 67; }; node_69(){ required 56 30 16 34 68; }; node_70(){
+required 56 30 16 35; }; node_71(){ required 56 30 16 36; }; node_72(){
+required 56 30 16 37; }; node_73(){ required 56 30 16 38 18 19; }; node_74(){
+optional 17; }; node_75(){ required 56 30 16 39 74; }; node_76(){
+required 56 30 16 40; }; node_77(){ required 56 30 16 41 68; }; node_78(){
+either 42 43; }; node_79(){ required 78; }; node_80(){ optional 12; }
+node_81(){ required 56 30 16 79 80; }; node_82(){ optional 13; }; node_83(){
+optional 14; }; node_84(){ oneormore 20; }; node_85(){
+required 56 30 16 44 82 83 17 84; }; node_86(){ required 21 22; }; node_87(){
+either 86 11; }; node_88(){ required 87; }; node_89(){ optional 23; }
+node_90(){ required 56 30 16 45 46 88 89 64; }; node_91(){
+required 56 30 16 45 47 21 22 24 64; }; node_92(){ either 21 11; }; node_93(){
+required 92; }; node_94(){ required 56 30 16 45 79 93 64 80; }; node_95(){
+optional 84; }; node_96(){ required 56 30 16 25 95; }; node_97(){ optional 27; }
+node_98(){ optional 28; }; node_99(){ required 56 48 49 26 97 98; }; node_100(){
+required 56 48 58; }; node_101(){ required 56 48 26 42; }; node_102(){
+required 56 48 26 50; }; node_103(){ required 56 48 26 51 59; }; node_104(){
+required 56 52; }; node_105(){ required 56 53; }; node_106(){ oneormore 29; }
+node_107(){ optional 106; }; node_108(){ required 56 54 107; }; node_109(){
+either 61 66 69 70 71 72 73 75 76 77 81 85 90 91 94 96 99 100 101 102 103 104 105 108
+}; node_110(){ required 109; }; cat <<<' docopt_exit() {
+[[ -n $1 ]] && printf "%s\n" "$1" >&2; printf "%s\n" "${DOC:40:1223}" >&2
+exit 1; }'; unset var___skip_update var___env var___stack var___help \
+var___skip_check var___status var___server var___domain var___app_name \
+var___pass var___secrets var___all var___force var___no_tty var___user \
+var__type_ var__app_ var__service_ var__src_ var__dst_ var__args_ var__secret_ \
 var__version_ var__cmd_ var__data_ var__command_ var__host_ var__user_ \
-var__port_ var__subcommands_ var_app var_new var_list var_ls var_deploy \
-var_undeploy var_config var_delete var_rm var_logs var_cp var_check var_ps \
-var_run var_secret var_generate var_insert var_server var_add var_init \
-var_apps var_upgrade var_version var_help; parse 107 "$@"
-local prefix=${DOCOPT_PREFIX:-''}; unset "${prefix}__stack" \
-"${prefix}__skip_update" "${prefix}__help" "${prefix}__env" \
-"${prefix}__server" "${prefix}__domain" "${prefix}__app_name" \
-"${prefix}__pass" "${prefix}__secrets" "${prefix}__status" \
-"${prefix}__skip_check" "${prefix}__force" "${prefix}__no_tty" \
-"${prefix}__user" "${prefix}__all" "${prefix}_type_" "${prefix}_app_" \
-"${prefix}_service_" "${prefix}_src_" "${prefix}_dst_" "${prefix}_args_" \
-"${prefix}_secret_" "${prefix}_version_" "${prefix}_cmd_" "${prefix}_data_" \
-"${prefix}_command_" "${prefix}_host_" "${prefix}_user_" "${prefix}_port_" \
-"${prefix}_subcommands_" "${prefix}app" "${prefix}new" "${prefix}list" \
-"${prefix}ls" "${prefix}deploy" "${prefix}undeploy" "${prefix}config" \
-"${prefix}delete" "${prefix}rm" "${prefix}logs" "${prefix}cp" "${prefix}check" \
-"${prefix}ps" "${prefix}run" "${prefix}secret" "${prefix}generate" \
-"${prefix}insert" "${prefix}server" "${prefix}add" "${prefix}init" \
-"${prefix}apps" "${prefix}upgrade" "${prefix}version" "${prefix}help"
-eval "${prefix}"'__stack=${var___stack:-}'
+var__port_ var__subcommands_ var_app var_list var_ls var_new var_backup \
+var_deploy var_check var_config var_cp var_logs var_ps var_restore var_rm \
+var_delete var_run var_secret var_generate var_insert var_server var_add \
+var_init var_apps var_upgrade var_version var_help; parse 110 "$@"
+local prefix=${DOCOPT_PREFIX:-''}; unset "${prefix}__skip_update" \
+"${prefix}__env" "${prefix}__stack" "${prefix}__help" "${prefix}__skip_check" \
+"${prefix}__status" "${prefix}__server" "${prefix}__domain" \
+"${prefix}__app_name" "${prefix}__pass" "${prefix}__secrets" "${prefix}__all" \
+"${prefix}__force" "${prefix}__no_tty" "${prefix}__user" "${prefix}_type_" \
+"${prefix}_app_" "${prefix}_service_" "${prefix}_src_" "${prefix}_dst_" \
+"${prefix}_args_" "${prefix}_secret_" "${prefix}_version_" "${prefix}_cmd_" \
+"${prefix}_data_" "${prefix}_command_" "${prefix}_host_" "${prefix}_user_" \
+"${prefix}_port_" "${prefix}_subcommands_" "${prefix}app" "${prefix}list" \
+"${prefix}ls" "${prefix}new" "${prefix}backup" "${prefix}deploy" \
+"${prefix}check" "${prefix}config" "${prefix}cp" "${prefix}logs" "${prefix}ps" \
+"${prefix}restore" "${prefix}rm" "${prefix}delete" "${prefix}run" \
+"${prefix}secret" "${prefix}generate" "${prefix}insert" "${prefix}server" \
+"${prefix}add" "${prefix}init" "${prefix}apps" "${prefix}upgrade" \
+"${prefix}version" "${prefix}help"
 eval "${prefix}"'__skip_update=${var___skip_update:-false}'
-eval "${prefix}"'__help=${var___help:-false}'
 eval "${prefix}"'__env=${var___env:-}'
+eval "${prefix}"'__stack=${var___stack:-}'
+eval "${prefix}"'__help=${var___help:-false}'
+eval "${prefix}"'__skip_check=${var___skip_check:-false}'
+eval "${prefix}"'__status=${var___status:-false}'
 eval "${prefix}"'__server=${var___server:-}'
 eval "${prefix}"'__domain=${var___domain:-}'
 eval "${prefix}"'__app_name=${var___app_name:-}'
 eval "${prefix}"'__pass=${var___pass:-false}'
 eval "${prefix}"'__secrets=${var___secrets:-false}'
-eval "${prefix}"'__status=${var___status:-false}'
-eval "${prefix}"'__skip_check=${var___skip_check:-false}'
+eval "${prefix}"'__all=${var___all:-false}'
 eval "${prefix}"'__force=${var___force:-false}'
 eval "${prefix}"'__no_tty=${var___no_tty:-false}'
 eval "${prefix}"'__user=${var___user:-}'
-eval "${prefix}"'__all=${var___all:-false}'
 eval "${prefix}"'_type_=${var__type_:-}'; eval "${prefix}"'_app_=${var__app_:-}'
 eval "${prefix}"'_service_=${var__service_:-}'
 eval "${prefix}"'_src_=${var__src_:-}'; eval "${prefix}"'_dst_=${var__dst_:-}'
@@ -252,16 +255,18 @@ eval "${prefix}"'_port_=${var__port_:-}'
 if declare -p var__subcommands_ >/dev/null 2>&1; then
 eval "${prefix}"'_subcommands_=("${var__subcommands_[@]}")'; else
 eval "${prefix}"'_subcommands_=()'; fi; eval "${prefix}"'app=${var_app:-false}'
-eval "${prefix}"'new=${var_new:-false}'
 eval "${prefix}"'list=${var_list:-false}'; eval "${prefix}"'ls=${var_ls:-false}'
+eval "${prefix}"'new=${var_new:-false}'
+eval "${prefix}"'backup=${var_backup:-false}'
 eval "${prefix}"'deploy=${var_deploy:-false}'
-eval "${prefix}"'undeploy=${var_undeploy:-false}'
-eval "${prefix}"'config=${var_config:-false}'
-eval "${prefix}"'delete=${var_delete:-false}'
-eval "${prefix}"'rm=${var_rm:-false}'; eval "${prefix}"'logs=${var_logs:-false}'
-eval "${prefix}"'cp=${var_cp:-false}'
 eval "${prefix}"'check=${var_check:-false}'
-eval "${prefix}"'ps=${var_ps:-false}'; eval "${prefix}"'run=${var_run:-false}'
+eval "${prefix}"'config=${var_config:-false}'
+eval "${prefix}"'cp=${var_cp:-false}'; eval "${prefix}"'logs=${var_logs:-false}'
+eval "${prefix}"'ps=${var_ps:-false}'
+eval "${prefix}"'restore=${var_restore:-false}'
+eval "${prefix}"'rm=${var_rm:-false}'
+eval "${prefix}"'delete=${var_delete:-false}'
+eval "${prefix}"'run=${var_run:-false}'
 eval "${prefix}"'secret=${var_secret:-false}'
 eval "${prefix}"'generate=${var_generate:-false}'
 eval "${prefix}"'insert=${var_insert:-false}'
@@ -273,20 +278,21 @@ eval "${prefix}"'upgrade=${var_upgrade:-false}'
 eval "${prefix}"'version=${var_version:-false}'
 eval "${prefix}"'help=${var_help:-false}'; local docopt_i=1
 [[ $BASH_VERSION =~ ^4.3 ]] && docopt_i=2; for ((;docopt_i>0;docopt_i--)); do
-declare -p "${prefix}__stack" "${prefix}__skip_update" "${prefix}__help" \
-"${prefix}__env" "${prefix}__server" "${prefix}__domain" "${prefix}__app_name" \
-"${prefix}__pass" "${prefix}__secrets" "${prefix}__status" \
-"${prefix}__skip_check" "${prefix}__force" "${prefix}__no_tty" \
-"${prefix}__user" "${prefix}__all" "${prefix}_type_" "${prefix}_app_" \
+declare -p "${prefix}__skip_update" "${prefix}__env" "${prefix}__stack" \
+"${prefix}__help" "${prefix}__skip_check" "${prefix}__status" \
+"${prefix}__server" "${prefix}__domain" "${prefix}__app_name" \
+"${prefix}__pass" "${prefix}__secrets" "${prefix}__all" "${prefix}__force" \
+"${prefix}__no_tty" "${prefix}__user" "${prefix}_type_" "${prefix}_app_" \
 "${prefix}_service_" "${prefix}_src_" "${prefix}_dst_" "${prefix}_args_" \
 "${prefix}_secret_" "${prefix}_version_" "${prefix}_cmd_" "${prefix}_data_" \
 "${prefix}_command_" "${prefix}_host_" "${prefix}_user_" "${prefix}_port_" \
-"${prefix}_subcommands_" "${prefix}app" "${prefix}new" "${prefix}list" \
-"${prefix}ls" "${prefix}deploy" "${prefix}undeploy" "${prefix}config" \
-"${prefix}delete" "${prefix}rm" "${prefix}logs" "${prefix}cp" "${prefix}check" \
-"${prefix}ps" "${prefix}run" "${prefix}secret" "${prefix}generate" \
-"${prefix}insert" "${prefix}server" "${prefix}add" "${prefix}init" \
-"${prefix}apps" "${prefix}upgrade" "${prefix}version" "${prefix}help"; done; }
+"${prefix}_subcommands_" "${prefix}app" "${prefix}list" "${prefix}ls" \
+"${prefix}new" "${prefix}backup" "${prefix}deploy" "${prefix}check" \
+"${prefix}config" "${prefix}cp" "${prefix}logs" "${prefix}ps" \
+"${prefix}restore" "${prefix}rm" "${prefix}delete" "${prefix}run" \
+"${prefix}secret" "${prefix}generate" "${prefix}insert" "${prefix}server" \
+"${prefix}add" "${prefix}init" "${prefix}apps" "${prefix}upgrade" \
+"${prefix}version" "${prefix}help"; done; }
 # docopt parser above, complete command for generating this parser is `docopt.sh abra`
 
 PROGRAM_NAME=$(basename "$0")
@@ -677,6 +683,26 @@ sub_app_new (){
   echo "    abra app $APP_NAME deploy$(tput sgr0)"
 }
 
+###### .. app backup
+sub_app_backup (){
+  load_instance
+  load_instance_env
+
+  require_app_latest "$TYPE"
+
+  # Add _<service> if it's defined
+  FUNCTION="abra_backup${abra__service_:+_}$abra__service_"
+
+  if ! type "$FUNCTION" > /dev/null 2>&1; then
+    error "'$TYPE' doesn't know how to do ${abra__service_}${abra__service_:+ }backups."\
+      "See $GIT_URL$TYPE/issues/"
+  fi
+
+  mkdir -p "$ABRA_DIR/backups"
+
+  $FUNCTION
+}
+
 ###### .. app deploy
 help_app_deploy (){
   echo "abra [options] app <domain> deploy [--skip-check]