diff --git a/backup b/backup
index ae6c9be..44ac571 100755
--- a/backup
+++ b/backup
@@ -2,14 +2,14 @@
 
 set -e
 
-NOW=$(date +%y%m%d%H%M%S)
+NOW=$(date +%y%m%d-%H%M%S)
 CRON=""
 if [ "$1" == "cron" ]; then
-    CRON="${1}_"
+    CRON="_${1}"
     TODAY=`date '+%Y_%m_%d'`
     echo "Running cron-$(basename $0) for ${TODAY}..."
 fi
-BASE=${HOSTNAME}_${CRON}${NOW}
+BASE=${NOW}_${HOSTNAME}${CRON}
 TMPDIR=/tmp/$BASE
 mkdir -p $TMPDIR
 mkdir -p /backup
diff --git a/gui/main.go b/gui/main.go
index 13bf213..fdb40e8 100644
--- a/gui/main.go
+++ b/gui/main.go
@@ -2459,6 +2459,8 @@ func main() {
 	r.HandleFunc("/certificates/{id}", certificateHandler).Methods("GET")
 	r.HandleFunc("/certificates/{id}", certRevokeHandler).Methods("POST")
 
+	r.PathPrefix("/backup/").Handler(http.StripPrefix("/backup/", http.FileServer(http.Dir("/backup"))))
+
 	r.NotFoundHandler = http.HandlerFunc(notFoundHandler)
 	if isDev {
 		r.PathPrefix("/accounts/static/").Handler(http.StripPrefix("/accounts/static/", http.FileServer(http.Dir("../static"))))
diff --git a/gui/templates/views/manage.tmpl b/gui/templates/views/manage.tmpl
index 02b63ac..9cd782c 100644
--- a/gui/templates/views/manage.tmpl
+++ b/gui/templates/views/manage.tmpl
@@ -72,7 +72,7 @@
           <tbody id="backups-tbody">
             {{ range .BackupFiles }}
             <tr>
-              <td class="vmiddle">{{ . }}</td>
+              <td class="vmiddle"><a href="/admin/backup/{{.}}" class="backupdl">{{.}}</a></td>
               <td class="vmiddle">
                 <button class="btn btn-outline btn-warning backup-restore" type="button" title="Restore this backup">Restore</button>
                 <button class="btn btn-outline btn-danger backup-delete" type="button" title="Delete this backup">Delete</button>
@@ -86,8 +86,8 @@
       </div>
       <div class="col-lg-6 col-md-9 col-sm-12">
         <div class="well">
-          Backups are automatically created once a week. Here you can manually create extra backups, delete
-          backups or restore a selected backup.<br/> After restoring the services will be <b>automatically restarted</b>.<br/>
+          Backups are automatically created once a week. Here you can manually create extra backups and download, delete
+          or restore a selected backup.<br/> After restoring the services will be <b>automatically restarted</b>.<br/>
           Automatic backups are removed after one month, manual backups are kept until manually deleted.
         </div>
       </div>
@@ -294,6 +294,13 @@
                 }, 250);
             });
 
+            $(".backupdl").click(function(evt) {
+                if (!window.confirm("WARNING: this backup file contains the private keys and other sensitive data in unprotected form. You should be very careful where you store it. Do you want to continue?")) {
+                    return false;
+                }
+            });
+
+
             $(".btn").click(function(evt) {
                 $('#modal-spinner').modal('show');
                 if ($(evt.target).hasClass('btn-warning') || $(evt.target).hasClass('btn-danger')) {
@@ -329,7 +336,7 @@
                             var msg = "Successfully created backup";
                             $("#backup-result").removeClass("hidden").removeClass("error").show().text(msg).addClass("success");
 
-                            $("#backups-tbody").append('<tr><td class="vmiddle">' + data.Message + '</td><td class="vmiddle"></td></tr>');
+                            $("#backups-tbody").append('<tr><td class="vmiddle"><a href="/admin/backup/' + data.Message + '" class="backupdl">' + data.Message + '</a></td><td class="vmiddle"></td></tr>');
 
                         } else {
                             $("#backup-result").removeClass("hidden").removeClass("success").show().text(data.Message).addClass("error");
diff --git a/patches/docker-compose.patch b/patches/docker-compose.patch
index 87ff983..27368f9 100644
--- a/patches/docker-compose.patch
+++ b/patches/docker-compose.patch
@@ -50,7 +50,7 @@ index b7e5656c5..3b82e8651 100644
      networks:
        bluenet:
          aliases:
-@@ -56,21 +65,72 @@ services:
+@@ -56,21 +65,73 @@ services:
      # small.
      command: mysqld --bind-address=0.0.0.0 --slow-query-log --log-output=TABLE --log-queries-not-using-indexes=ON
      logging:
@@ -71,6 +71,7 @@ index b7e5656c5..3b82e8651 100644
 +      - /home/labca/admin:/go/src/labca
 +      - ./.gocache:/root/.cache/go-build
 +      - /home/labca/nginx_data/static:/wwwstatic
++      - /home/labca/backup:/backup
 +      - .:/boulder
 +      - /home/labca/boulder_labca:/boulder/labca
 +    expose: