I like borg with rsync.
this post was submitted on 22 Apr 2025
30 points (94.1% liked)
Selfhosted
46212 readers
506 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (donβt cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
I went a little crazy and setup my own wireguard VPN network, all the remote hosts connect to the VPN and the primary server connects to each of them and pushes backups. Because I use btrfs and lots of snapshots I use btrbk, annoying to setup but now my hourly snapshots get pushed everywhere, minimal bandwidth and it flawlessly has worked for years.
Configure and Pre backup the drives before bringing them to family members to save yourself some bandwidth
Definitely a good suggestion!
As for the other question in thr post: If you are using btrfs or zfs I believe both of those have a send function that operates at a block level and will only send block changes rather than full file changes
I use sync thing with untrusted keys. That way the data ends up in multiple locations but it's not accessible remotely. If you don't care about the data and the locations you don't have to do that but it's a nice feature.
I have an offsite NAS where I run the Restic REST server as a docker container. I connect to it over Nebula but you could also use a traditional VPN, Tailscale, Headscale, Pangolin or whatever.
Works like a charm.
Tailscale+Headscale or Zerotier, use whatever backup software you want for the local backups. Simple script to rsync backups to other sites and remove copies past a certain age.
Pretty simple, and no need to expose machines in any less than safe ways.
Why Tailscale AND Headscale? Arent't they the same thing?
Tailscale is both a client and server. If you use only Tailscale, you have to pay for the service after so many devices are connected, which by all means support the company and do so and avoid using Headscale.
Headscale is an open source implementation of the Tailscale service, so it's free to use with all the usual Tailscale clients published. You setup Headscale somewhere, register your Tailscale clients to it, and use it like usual. It's just skipping the need to pay for Tailscale servers as a service, and gives you greater control over how traffic routed. Completely optional.
Yeah but it's like 100 devices, I think. And I believe 3 users (meaning under one account; sharing a device with someone who makes their own account doesn't count as a "user"). You're right, but they're pretty generous.
I don't think it takes many resources to provide the service to consumers; it's not like you're using any of their bandwidth (minus the tiny amount used for coordination between clients). Oh, or if you use their DERP servers (encrypted, but still).
In general, people should know there are self hosted, truly private options, though. So thanks for mentioning Headscale.
I'd do it like this:
-
borg backup
-
(optional) borgmatic for easier use, but a diy shell script might suffice
-
(optional) https://github.com/Ravinou/borgwarehouse for easier gui based "serverside" setup on each location
-
(if you have no way to reach the servers from the internet yet) set up dyndns for each location so you can reach them by domain
-
might need to setup portforwarding rules in the router of each location
Didnβt know about borg warehouse. Thanks for the heads up!
You don't want to send as that's means that an adversary can delete the backups.
Make each one do a pull instead.
Huh?
Configure each backup machine to read from the data you are backing up
You can do it that way, but I don't see how that's more secure. Fewer server bits to maintain I guess?
I think what he means is that if your backup is triggered from your main server and your main server is compromised the backups can also be attacked immediately. If the backup is requested from the backup machine you will at least have the time between the attack and the next backup to prevent the attack from reaching your backup machines.
I'm sorry, but I still don't understand what you mean. Could you please elaborate bit? Thanks!
You configure the backup systems to connect to the device to be backed up. The idea is if something bad happens on the main machine it won't impact the backups
I use rsync for a similar system. One of the nice things is that you can set a bandwidth limit so that it doesn't saturate your family's internet connections.