@@ -143,6 +143,9 @@ public void setVmState(VirtualMachine.State vmState) {
 
     @LogLevel(LogLevel.Log4jLevel.Off)
     private String mountOptions;
+    /** LUKS passphrase for backups taken with nas.backup.encryption.enabled; null for plain backups. Never logged. */
+    @LogLevel(LogLevel.Log4jLevel.Off)
+    private String encryptionPassphrase;
     @Override
 
     public boolean executeInSequence() {
@@ -153,6 +156,14 @@ public List<String> getBackupVolumesUUIDs() {
         return backupVolumesUUIDs;
     }
 
+    public String getEncryptionPassphrase() {
+        return encryptionPassphrase;
+    }
+
+    public void setEncryptionPassphrase(String encryptionPassphrase) {
+        this.encryptionPassphrase = encryptionPassphrase;
+    }
+
     public void setBackupVolumesUUIDs(List<String> backupVolumesUUIDs) {
         this.backupVolumesUUIDs = backupVolumesUUIDs;
     }
 
@@ -23,9 +23,20 @@
 import com.cloud.agent.api.LogLevel;
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
 
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 public class TakeBackupCommand extends Command {
+    // Detail-map keys shared between the management server (NASBackupProvider) and
+    // the KVM agent wrapper. Defining them once here avoids drift between producer
+    // and consumer when a key is renamed.
+    public static final String DETAIL_COMPRESSION = "compression";
+    public static final String DETAIL_ENCRYPTION = "encryption";
+    public static final String DETAIL_ENCRYPTION_PASSPHRASE = "encryption_passphrase";
+    public static final String DETAIL_BANDWIDTH_LIMIT = "bandwidth_limit";
+    public static final String DETAIL_INTEGRITY_CHECK = "integrity_check";
+
     private String vmName;
     private String backupPath;
     private String backupRepoType;
@@ -36,6 +47,8 @@ public class TakeBackupCommand extends Command {
     private Integer quiesceTimeout;
     @LogLevel(LogLevel.Log4jLevel.Off)
     private String mountOptions;
+    @LogLevel(LogLevel.Log4jLevel.Off)
+    private Map<String, String> details = new HashMap<>();
 
     // Incremental backup fields (NAS provider; null/empty for legacy full-only callers).
     private String mode;          // "full" or "incremental"; null => legacy behaviour (script default)
@@ -118,6 +131,18 @@ public void setQuiesce(Boolean quiesce) {
         this.quiesce = quiesce;
     }
 
+    public Map<String, String> getDetails() {
+        return details;
+    }
+
+    public void setDetails(Map<String, String> details) {
+        this.details = details != null ? details : new HashMap<>();
+    }
+
+    public void addDetail(String key, String value) {
+        this.details.put(key, value);
+    }
+
     public Integer getQuiesceTimeout() {
         return quiesceTimeout;
     }
 
@@ -95,6 +95,15 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
             true,
             BackupFrameworkEnabled.key());
 
+    ConfigKey<Boolean> NASBackupCompressionEnabled = new ConfigKey<>("Advanced", Boolean.class,
+            "nas.backup.compression.enabled",
+            "false",
+            "Enable qcow2 compression for NAS backup files. Cannot be combined with nas.backup.encryption.enabled "
+            + "(qcow2 cannot compress and encrypt the same image); backups fail with a clear error if both are on.",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
     ConfigKey<Boolean> NASBackupIncrementalEnabled = new ConfigKey<>("Advanced", Boolean.class,
             "nas.backup.incremental.enabled",
             "false",
@@ -108,6 +117,39 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
             ConfigKey.Scope.Zone,
             BackupFrameworkEnabled.key());
 
+    ConfigKey<Boolean> NASBackupEncryptionEnabled = new ConfigKey<>("Advanced", Boolean.class,
+            "nas.backup.encryption.enabled",
+            "false",
+            "Enable LUKS encryption for NAS backup files. Cannot be combined with nas.backup.compression.enabled.",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
+    ConfigKey<String> NASBackupEncryptionPassphrase = new ConfigKey<>("Secure", String.class,
+            "nas.backup.encryption.passphrase",
+            "",
+            "Passphrase for LUKS encryption of NAS backup files. Required when encryption is enabled. Restores use the "
+            + "current value, so changing it makes backups taken with the old passphrase unrestorable until it is set back.",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
+    ConfigKey<Integer> NASBackupBandwidthLimitMbps = new ConfigKey<>("Advanced", Integer.class,
+            "nas.backup.bandwidth.limit.mbps",
+            "0",
+            "Bandwidth limit in MiB/s for backup operations (0 = unlimited).",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
+    ConfigKey<Boolean> NASBackupIntegrityCheckEnabled = new ConfigKey<>("Advanced", Boolean.class,
+            "nas.backup.integrity.check",
+            "false",
+            "Run qemu-img check on backup files after creation to verify integrity.",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
     ConfigKey<Integer> NASBackupFullEvery = new ConfigKey<>("Advanced", Integer.class,
             "nas.backup.full.every",
             "10",
@@ -298,6 +340,16 @@ protected ChainDecision decideChain(VirtualMachine vm) {
             return ChainDecision.legacyFull();
         }
 
+        // Compression and LUKS encryption rewrite each backup file with qemu-img convert. On an
+        // incremental file that either flattens it through its backing chain (a full-size copy that
+        // defeats the chain) or leaves an encrypted child whose parent needs its own secret to open.
+        // Until both features are chain-aware, a zone with either one enabled takes full backups.
+        Long zoneId = vm.getDataCenterId();
+        if (Boolean.TRUE.equals(NASBackupCompressionEnabled.valueIn(zoneId))
+                || Boolean.TRUE.equals(NASBackupEncryptionEnabled.valueIn(zoneId))) {
+            return ChainDecision.legacyFull();
+        }
+
         // Incremental backups rely on QEMU dirty bitmaps / libvirt checkpoints, which only exist
         // on file-based qcow2 storage. Storage such as Ceph-RBD and Linstor cannot carry per-disk
         // checkpoints, so a VM with any volume on such a pool must stay on the full-only (legacy)
@@ -585,8 +637,11 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         // (libvirt backup-begin requires a running QEMU process).
         ChainDecision decision = decideChain(vm);
 
-        BackupVO backupVO = createBackupObject(vm, backupPath, decision.isIncremental() ? "INCREMENTAL" : "FULL");
         TakeBackupCommand command = new TakeBackupCommand(vm.getInstanceName(), backupPath);
+        // Validate and apply the zone's enhancement settings before any backup row exists, so a
+        // misconfiguration (encryption without a passphrase, compression together with encryption)
+        // fails the request without leaving a backup stuck in BackingUp.
+        applyBackupEnhancementDetails(command, vm.getDataCenterId());
         command.setBackupRepoType(backupRepository.getType());
         command.setBackupRepoAddress(backupRepository.getAddress());
         command.setMountOptions(backupRepository.getMountOptions());
@@ -605,6 +660,7 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
             command.setVolumePaths(volumePoolsAndPaths.second());
         }
 
+        BackupVO backupVO = createBackupObject(vm, backupPath, decision.isIncremental() ? "INCREMENTAL" : "FULL");
         BackupAnswer answer;
         try {
             answer = (BackupAnswer) agentManager.send(host.getId(), command);
@@ -669,6 +725,39 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         }
     }
 
+    /**
+     * Translates the zone-scoped backup-enhancement settings (compression, encryption,
+     * bandwidth limit, integrity check) into details on the {@link TakeBackupCommand}.
+     * Fails fast, before any backup row is created, if encryption is enabled without a configured
+     * passphrase or together with compression (qcow2 cannot compress and encrypt the same image).
+     */
+    protected void applyBackupEnhancementDetails(TakeBackupCommand command, Long zoneId) {
+        if (Boolean.TRUE.equals(NASBackupCompressionEnabled.valueIn(zoneId))
+                && Boolean.TRUE.equals(NASBackupEncryptionEnabled.valueIn(zoneId))) {
+            throw new CloudRuntimeException(String.format("%s and %s are both enabled for zone %d, but qcow2 cannot compress and "
+                    + "encrypt the same image. Disable one of them for this zone; no backup was taken.",
+                    NASBackupCompressionEnabled.key(), NASBackupEncryptionEnabled.key(), zoneId));
+        }
+        if (Boolean.TRUE.equals(NASBackupCompressionEnabled.valueIn(zoneId))) {
+            command.addDetail(TakeBackupCommand.DETAIL_COMPRESSION, "true");
+        }
+        if (Boolean.TRUE.equals(NASBackupEncryptionEnabled.valueIn(zoneId))) {
+            String passphrase = NASBackupEncryptionPassphrase.valueIn(zoneId);
+            if (passphrase == null || passphrase.isEmpty()) {
+                throw new CloudRuntimeException("NAS backup encryption is enabled but no passphrase is configured (nas.backup.encryption.passphrase)");
+            }
+            command.addDetail(TakeBackupCommand.DETAIL_ENCRYPTION, "true");
+            command.addDetail(TakeBackupCommand.DETAIL_ENCRYPTION_PASSPHRASE, passphrase);
+        }
+        Integer bandwidthLimit = NASBackupBandwidthLimitMbps.valueIn(zoneId);
+        if (bandwidthLimit != null && bandwidthLimit > 0) {
+            command.addDetail(TakeBackupCommand.DETAIL_BANDWIDTH_LIMIT, String.valueOf(bandwidthLimit));
+        }
+        if (Boolean.TRUE.equals(NASBackupIntegrityCheckEnabled.valueIn(zoneId))) {
+            command.addDetail(TakeBackupCommand.DETAIL_INTEGRITY_CHECK, "true");
+        }
+    }
+
     /**
      * Alerts when nasbackup.sh could not clean up after a failed backup. The script's output
      * names the backup repository mount point it left on the host.
@@ -706,6 +795,19 @@ private BackupVO createBackupObject(VirtualMachine vm, String backupPath, String
         return backupDao.persist(backup);
     }
 
+    /**
+     * Restore-side counterpart of {@link #applyBackupEnhancementDetails}: hands the zone's LUKS passphrase
+     * to the host so encrypted backup files can be checked and converted back. It is sent whenever a
+     * passphrase is configured, not only while encryption is switched on, so backups taken before
+     * encryption was disabled stay restorable; the host ignores it for plain backups.
+     */
+    protected void applyRestoreEncryptionDetails(RestoreBackupCommand command, Long zoneId) {
+        String passphrase = NASBackupEncryptionPassphrase.valueIn(zoneId);
+        if (passphrase != null && !passphrase.isEmpty()) {
+            command.setEncryptionPassphrase(passphrase);
+        }
+    }
+
     @Override
     public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid) {
         return restoreVMBackup(vm, backup);
@@ -745,6 +847,7 @@ private Pair<Boolean, String> restoreVMBackup(VirtualMachine vm, Backup backup)
         restoreCommand.setVmExists(vm.getRemoved() == null);
         restoreCommand.setVmState(vm.getState());
         restoreCommand.setMountTimeout(NASBackupRestoreMountTimeout.value());
+        applyRestoreEncryptionDetails(restoreCommand, vm.getDataCenterId());
 
         BackupAnswer answer;
         try {
@@ -870,6 +973,7 @@ public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeI
         restoreCommand.setVmState(vmNameAndState.second());
         restoreCommand.setMountTimeout(NASBackupRestoreMountTimeout.value());
         restoreCommand.setBackupFiles(Collections.singletonList(matchingVolume.getPath()));
+        applyRestoreEncryptionDetails(restoreCommand, backup.getZoneId());
 
         BackupAnswer answer;
         try {
@@ -1281,6 +1385,11 @@ public Boolean crossZoneInstanceCreationEnabled(BackupOffering backupOffering) {
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey[]{
                 NASBackupRestoreMountTimeout,
+                NASBackupCompressionEnabled,
+                NASBackupEncryptionEnabled,
+                NASBackupEncryptionPassphrase,
+                NASBackupBandwidthLimitMbps,
+                NASBackupIntegrityCheckEnabled,
                 NASBackupFullEvery,
                 NASBackupIncrementalEnabled,
                 NASBackupQuiesceAgentTimeout