this post was submitted on 17 Oct 2026
23 points (100.0% liked)

Selfhosted

63017 readers
1324 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
23
Backup (lemmy.world)
submitted 14 hours ago by Good_Slate@lemmy.world to c/selfhosted@lemmy.world
12 comments fedilink hide all child comments
 

I view my photos using immich, historically I used photo prism with photosync to back them up.

My photos are stored on my nas (omv), immich is on my android and I access it through wireguard.

My nas is raidz1 with 4 drives, so it is relatively resilient. The photos are backed up to a separate external hard drive too using borgbackup.

What i'd like to do is the following: Back up my photos externally - at a family members house with a pi zero connected to a hard drive, which would be connected to their WiFi or via an ethernet cable to the router.

Ideally, the first backup should be done at home before, I don't want to backup 100's GB over the internet.

Would a simple wireguard tunnel be ok here? Should a different method be used?

Has anyone done such a thing? I read a lot about vps, but I don't what the ongoing commitment in cost when I have a free option.

One of my worries is that I don't want a compromised device on the family member's network to compromise mine, would the wireguard tunnel be enough to secure it? Would WiFi be more secure than ethernet cable?

you are viewing a single comment's thread
view the rest of the comments
[–] miaowoo_lw@lemmy.world 0 points 5 hours ago

Yes, this works and people do exactly this — but a few things will make or break it:

Borg client-side encryption solves your trust worry. The Pi only ever sees encrypted chunks, so it doesn't matter that it sits on a family member's network. They can't read a thing, and they can't even see file names. Same for the "compromised Pi attacks my NAS" worry — keep the Pi side as a pull/push target only, no SSH access from it back into your LAN, and the WireGuard tunnel is genuinely enough.

NAT traversal is the real friction. With plain WireGuard between two home NATs you'll be fighting dynamic IPs and CGNAT. Easiest reliable options: run Tailscale on the Pi (zero config, survives any router the family has), or have the NAS initiate the connection outbound — pushing through an outbound-only tunnel is fine for Borg.

Seed at home, then let deltas flow. Do the first full backup at home, then move the disk. Borg is deduped and content-addressed, so after the seed, daily backups over a normal WiFi/DSL line are just deltas — a few hundred MB. No VPS needed unless the family setup proves unreliable.

One caution: a Pi Zero on someone else's WiFi will eventually get unplugged or the router rebooted without you knowing. Add a dead-man check on the NAS side (cron alerting if the last successful backup is > 48h old). "Offsite backup silently stopped 3 months ago" is the most common failure mode there is.