diff --git a/src/dda/backup/backup/domain.clj b/src/dda/backup/backup/domain.clj
index 89d0186..a85339b 100644
--- a/src/dda/backup/backup/domain.clj
+++ b/src/dda/backup/backup/domain.clj
@@ -8,7 +8,7 @@
 (s/def ::files (s/+ string?))
 
 (s/def ::backup-file-config
-  (s/merge ::rd/config
+  (s/merge ::rd/restic-config
            (s/keys :req-un [::files])))
 
 (defn-spec backup-files-command ::cd/commands
diff --git a/src/dda/backup/postgresql/domain.clj b/src/dda/backup/postgresql/domain.clj
index f873605..7b32321 100644
--- a/src/dda/backup/postgresql/domain.clj
+++ b/src/dda/backup/postgresql/domain.clj
@@ -2,15 +2,18 @@
   (:require
    [orchestra.core :refer [defn-spec]]
    [clojure.spec.alpha :as s]
-   [dda.backup.core.domain :as cd]))
+   [clojure.string :as st]
+   [dda.backup.core.domain :as cd]
+   [dda.backup.restic.domain :as rd]))
 
 (s/def ::pg-host string?)
 (s/def ::pg-port pos-int?)
 (s/def ::pg-db string?)
 (s/def ::pg-user string?)
 (s/def ::pg-password string?)
+(s/def ::pg-role-prefix string?)
 
-(s/def ::config
+(s/def ::pg-config
   (s/keys :req-un [::pg-host
                    ::pg-port
                    ::pg-db
@@ -18,8 +21,14 @@
                    ::pg-user]
           :opt-un []))
 
+(s/def ::pg-role-config
+  (s/merge ::pg-config
+           ::rd/restic-config
+           (s/keys :req-un [::pg-role-prefix]
+                   :opt-un [])))
+
 (defn-spec psql-command ::cd/command
-  [config ::config
+  [config ::pg-config
    command ::cd/command]
   (let [{:keys [pg-host pg-port pg-user]} config]
     (into
@@ -27,13 +36,32 @@
       "--no-password" "-c"]
      command)))
 
+(defn-spec pgdumpall-command ::cd/command
+  [config ::pg-role-config
+   command ::cd/command]
+  (let [{:keys [pg-host pg-port pg-user pg-role-prefix]} config]
+    (into
+     []
+     (concat
+      ["pg_dumpall" "-h" pg-host "-p" (str pg-port) "-U" pg-user
+       "--no-password"]
+      command
+      ["|" "grep" pg-role-prefix "|"]
+      (rd/repo-command config ["backup" "--stdin"])
+      ))))
+
 (defn-spec pgpass string?
-  [config ::config]
+  [config ::pg-config]
   (let [{:keys [pg-host pg-db pg-user pg-password]} config]
     (str pg-host ":" pg-db ":" pg-user ":" pg-password)))
 
 (defn-spec db-drop-create-command ::cd/commands
-  [config ::config]
+  [config ::pg-config]
   (let [{:keys [pg-db]} config]
     [(psql-command config [(str "\"DROP DATABASE \\\"" pg-db "\\\";\"")])
      (psql-command config [(str "\"CREATE DATABASE \\\"" pg-db "\\\";\"")])]))
+
+(defn-spec backup-role-command ::cd/commands
+  [config ::pg-role-config]
+  (let [{:keys [pg-db]} config]
+    ["bash" "-c" (st/join " " (pgdumpall-command config ["--roles-only"]))]))
diff --git a/test/dda/backup/postgresql/domain_test.clj b/test/dda/backup/postgresql/domain_test.clj
index eb62e17..1da7fe7 100644
--- a/test/dda/backup/postgresql/domain_test.clj
+++ b/test/dda/backup/postgresql/domain_test.clj
@@ -6,6 +6,7 @@
 
 (st/instrument `cut/pgpass)
 (st/instrument `cut/db-drop-create-command)
+(st/instrument `cut/backup-role-command)
 
 (deftest should-calculate-pgpass
   (is (= "localhost:mydb:user:password"
@@ -29,3 +30,16 @@
                                       :pg-db "mydb"
                                       :pg-user "user"
                                       :pg-password "password"}))))
+
+(deftest should-calculate-backup-role-command
+  (is (= [["bash" "-c" "pg_dumpall -h localhost -p 5432 -U user --no-password --roles-only | grep prefix | restic -r repo/dir-at-repo -v backup --stdin"]]
+         (cut/backup-role-command {:restic-repository "repo"
+                                   :backup-path "dir-at-repo"
+                                   :days-to-keep 39
+                                   :months-to-keep 3
+                                   :pg-host "localhost"
+                                   :pg-port 5432
+                                   :pg-db "mydb"
+                                   :pg-role-prefix "prefix"
+                                   :pg-user "user"
+                                   :pg-password "password"}))))