I’m planning on setting up a nas/home server (primarily storage with some jellyfin and nextcloud and such mixed in) and since it is primarily for data storage I’d like to follow the data preservation rules of 3-2-1 backups. 3 copies on 2 mediums with 1 offsite - well actually I’m more trying to go for a 2-1 with 2 copies and one offsite, but that’s besides the point. Now I’m wondering how to do the offsite backup properly.

My main goal would be to have an automatic system that does full system backups at a reasonable rate (I assume daily would be a bit much considering it’s gonna be a few TB worth of HDDs which aren’t exactly fast, but maybe weekly?) and then have 2-3 of those backups offsite at once as a sort of version control, if possible.

This has two components, the local upload system and the offsite storage provider. First the local system:

What is good software to encrypt the data before/while it’s uploaded?

While I’d preferably upload the data to a provider I trust, accidents happen, and since they don’t need to access the data, I’d prefer them not being able to, maliciously or not, so what is a good way to encrypt the data before it leaves my system?

What is a good way to upload the data?

After it has been encrypted, it needs to be sent. Is there any good software that can upload backups automatically on regular intervals? Maybe something that also handles the encryption part on the way?

Then there’s the offsite storage provider. Personally I’d appreciate as many suggestions as possible, as there is of course no one size fits all, so if you’ve got good experiences with any, please do send their names. I’m basically just looking for network attached drives. I send my data to them, I leave it there and trust it stays there, and in case too many drives in my system fail for RAID-Z to handle, so 2, I’d like to be able to get the data off there after I’ve replaced my drives. That’s all I really need from them.

For reference, this is gonna be my first NAS/Server/Anything of this sort. I realize it’s mostly a regular computer and am familiar enough with Linux, so I can handle that basic stuff, but for the things you wouldn’t do with a normal computer I am quite unfamiliar, so if any questions here seem dumb, I apologize. Thank you in advance for any information!

  • Ulrich@feddit.orgEnglish
    2·
    1 hour ago

    I assume daily would be a bit much considering it’s gonna be a few TB worth of HDDs which aren’t exactly fast

    What is the concern here?

  • glizzyguzzler@lemmy.blahaj.zoneEnglish
    1·
    1 hour ago

    I got my parents to get a NAS box, stuck it in their basement. They need to back up their stuff anyway. I put in 2 18 TB drives (mirrored) from server part deals (peeps have said that site has jacked their prices, look for alts). They only need like 4 TB at most. I made a backup samba share for myself. It’s the cheapest symbology box possible, their software to make a samba share with a quota.

    I then set up a wireguard connection on an RPi, taped that to the NAS, and wireguard to the local network with a batch script. Mount the samba share and then use restic to back up my data. It works great. Restic is encrypted, I don’t have to pay for storage monthly, their electricity is cheap af, they have backups, I keep tabs on it, everyone wins.

    Next step is to go the opposite way for them, but no rush on that goal, I don’t think their basement would get totaled in a fire and I don’t think their house (other than the basement) would get totaled in a flood.

    If you don’t have a friend or relative to do a box-at-their-house (peeps might be enticed with reciprocal backups), restic still fits the bill. Destination is encrypted, has simple commands to check data for validity.

    Rclone crypt is not good enough. Too many issues (path length limits, password “obscured” but otherwise there, file structure preserved even if names are encrypted). On a VPS I use rclone to be a pass-through for restic to backup a small amount of data to a goog drive. Works great. Just don’t fuck with the rclone crypt for major stuff.

    Lastly I do use rclone crypt to upload a copy of the restic binary to the destination, as the crypt means the binary can’t be fucked with and the binary there means that is all you need to recover the data.

  • frozencow@lemmy.worldEnglish
    1·
    3 hours ago

    I also had been contenplating this for a while. The solution I implemented recently is:

    The system itself is a RPI on NixOS. The system can be reproduced from the NixOS configuration. The NixOS configuration is stored on GitHub. Since I can reproduce the sdcard image (and full system) from the configuration I opted to not do any backup of the sdcard/system itself.

    I’ve also opted to not use raid, as I can replace/add a RPI without too much hassle.

    The real backups for me are for photos. Those are stored on a M.2 storage. A second (similar) RPI is placed at my dad’s place. The rpis run tailscale and syncthing. Syncthing syncs using staggered mode (stores 1 version for the last day/week/year) and the RPI at my dad is untrusted, so the backup files are sent/stored encrypted there.

    This setup hasn’t run very long yet, so I won’t recommend it, but it seems to check quite a lot of boxes for me. Maybe it gives some ideas. I’m also interested what alternative solutions others came up with.

  • merthyr1831@lemmy.mlEnglish
    8·
    6 hours ago

    Rsync to a Hetzner storage box. I dont do ALL my data, just the nextcloud data. The rest is…linux ISOs… so I can redownload at my convenience.

  • lightnsfw@reddthat.comEnglish
    4·
    9 hours ago

    It’s not all my data but I use backblaze for offsite backup. One of the reasons I can’t drop Windows. I don’t have anywhere I travel often enough to do a physical drop off and when I tried setting a file server up at my parents but they would break shit by fucking with their router every time they had an internet outage or moving it around (despite repeated being told to call me first).

      • sudneo@lemm.eeEnglish
        2·
        4 hours ago

        Objdct storage is anyway something I prefer over their app. Restic(/rustic) does the backup client side. B2 or any other storage to just save the data. This way you also have no vendor lock.

    • kalpol@lemm.eeEnglish
      1·
      8 hours ago

      Same - can sync snapshots from Truenas to Backblaze.

      If you want to get real fancy you could stash an N40L cube server at your mom’s house where she will never find it and VPN back to your local network and replicate snapshots to it

  • pHr34kY@lemmy.worldEnglish
    10·
    12 hours ago

    I have a job, and the office is 35km away. I get a locker in my office.

    I have two backup drives, and every month or so, I will rotate them by taking one into the office and bringing the other home. I do this immediately after running a backup.

    The drives are LUKS encrypted btrfs. Btrfs allows snapshots and compression. LUKS enables me to securely password protect the drive. My backup job is just a btrfs snapshot followed by an rsync command.

    I don’t trust cloud backups. There was an event at work where Google Cloud accidentally deleted an entire company just as I was about to start a project there.

  • liliumstar@lemmy.dbzer0.comEnglish
    2·
    8 hours ago

    I have a storage VPS and use Borg backup with Borgmatic. In my case, I have multiple systems in different repos on the remote. There are several providers, such as hetzner, borgbase, and rsync.net that offer borg storage, in the event you don’t want to manage the server yourself.

  • iknowitwheniseeit@lemmynsfw.comEnglish
    5·
    11 hours ago

    I just use restic.

    I’m pretty sure it uses checksums to verify data on the backup target, so it doesn’t need to copy all of the data there.

  • 7rokhym@lemmy.caEnglish
    2·
    12 hours ago

    I use Linux, so encryption is easy with LUKS, and Free File Sync to drives that rotate to a safety deposit box at the bank for catastrophic event, such as a house fire. Usually anything from the last few months are still on my mobile devices.

  • pinguin@fault.suEnglish
    1·
    13 hours ago

    I tend to just store all my backups off-site in multiple geographically distant locations, seems to work well

  • doodledup@lemmy.worldEnglish
    161·
    23 hours ago

    I’m just skipping that. How am I going to backup 48TB on an off-site backup?!

    • Censed@lemmy.zipEnglish
      2·
      7 hours ago

      You ought to only be 3-2-1ing you irreplaceable/essential files like personal photos, videos, and documents. Unless you’re a huge photography guy i can believe that takes up 48TB

    • Appoxo@lemmy.dbzer0.comEnglish
      17·
      16 hours ago

      Only back up the essentials like photos and documents or rare media.
      Don’t care about stuff like Avengers 4K that can easily be reaquired

      • dave@lemmy.wtfEnglish
        5·
        7 hours ago

        a “poor mans” backup can be useful for things like this, movie/tv/music collections, and will only be a few MB instead of TB.

        if things go south at least you can rebuild your collection in time. obviously if theres some rare files that were hard to get then you can backup those ones, but even at that it will probably still be a small backup

      • nfreak@lemmy.mlEnglish
        2·
        7 hours ago

        This is what I’m currently doing, I use backblaze b2 for basically everything that’s not movies/shows/music/roms, along with backing up my docker stacks etc to the same external drive my media’s currently on.

        I’m looking at a few good steps to upgrade this but nothing excessive:

        • NAS for media and storing local backups
        • Regular backups of everything but media to a small USB drive
        • Get a big ass external HDD that I’ll update once a month with everything and keep in my storage unit and ditch backblaze

        Not the cleanest setup but it’ll do the job. The media backup is definitely gonna be more of a 2-1-Pray system LMAO but at least the important things will be regularly taken care of

    • ryannathans@aussie.zoneEnglish
      63·
      23 hours ago

      Get a tiny ITX box with a couple 20TB refurbished HDDs, stick it at a friend’s house

      • doodledup@lemmy.worldEnglish
        62·
        22 hours ago

        In theory. But I already spent my pension for those 64TB drives (raidz2) xD. Getting off-site backup for all of that feels like such a waste of money (until you regret it). I know it isn’t a backup, but I’m praying the Raidz2 will be enough protection.

        • cwista@lemmy.worldEnglish
          3·
          11 hours ago

          The cost of storage is always more than double the sticker price. The hidden fee is that you need a second and maybe a third one and a system to put it all in. Most our operational lab cost is backups. I can’t replace the data if it’s lost.

        • SayCyberOnceMore@feddit.ukEnglish
          8·
          16 hours ago

          Just a friendly reminder that RAID is not a backup…

          Just consider if something accidentally overwrites some / all your files. This is a perfectly legit action and the checksums will happily match that new data, but your file(s) are gone…

          • doodledup@lemmy.worldEnglish
            1·
            5 hours ago

            I do weekly ZFS snapshots though and I’m very diligent on my smart tests and scrubs. I also have a UPS and a lot of power surge protection. And ECC Ram. It’s as safe as it gets. But having a backup would definitely be better, you’re right. I just can’t afford it for this much storage.

        • PeriodicallyPedantic@lemmy.caEnglish
          5·
          17 hours ago

          Do you have to back up everything off site?

          Maybe there are just a few critical files you need a disaster recovery plan for, and the rest is just covered by your raidz

          • doodledup@lemmy.worldEnglish
            1·
            3 hours ago

            I do backup like 1TB off-site. But it would still be a major blow if I lost the rest of it. I just try to live with that risk I’m fully aware exists.