this post was submitted on 17 Oct 2026
21 points (100.0% liked)

Selfhosted

63012 readers
1652 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.

  8. AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
ayyy@sh.itjust.works
curbstickle@anarchist.nexus
curbstickle_lw@lemmy.world
21
Backup (lemmy.world)
submitted 12 hours ago by Good_Slate@lemmy.world to c/selfhosted@lemmy.world
11 comments fedilink hide all child comments
 

I view my photos using immich, historically I used photo prism with photosync to back them up.

My photos are stored on my nas (omv), immich is on my android and I access it through wireguard.

My nas is raidz1 with 4 drives, so it is relatively resilient. The photos are backed up to a separate external hard drive too using borgbackup.

What i'd like to do is the following: Back up my photos externally - at a family members house with a pi zero connected to a hard drive, which would be connected to their WiFi or via an ethernet cable to the router.

Ideally, the first backup should be done at home before, I don't want to backup 100's GB over the internet.

Would a simple wireguard tunnel be ok here? Should a different method be used?

Has anyone done such a thing? I read a lot about vps, but I don't what the ongoing commitment in cost when I have a free option.

One of my worries is that I don't want a compromised device on the family member's network to compromise mine, would the wireguard tunnel be enough to secure it? Would WiFi be more secure than ethernet cable?

you are viewing a single comment's thread
view the rest of the comments
[–] miaowoo_sh@sh.itjust.works -1 points 4 hours ago

The WireGuard-tunnel-to-a-Pi-zero approach works well and is what I'd do — a few practical points from running a similar offsite backup:

Topology

  • Make the Pi dial out to your home WG server as a peer rather than listening — easier through the relative's NAT, no port forwarding on their router at all.
  • Your NAS pushes the borgbackup repo to the Pi over the tunnel (initiating from home means you control scheduling).

Initial seed

  • Right to seed locally: run the first borg init/create at home against the drive (plug the Pi's drive into your LAN once, or first sync during a family visit), then incremental deltas over WG are tiny. Re-seeds over the internet only ever happen if you plan a 'bring the drive home' maintenance visit per year or two.

Security between the networks

  • WireGuard is the isolation layer: restrict the Pi's AllowedIPs to just the WG subnet so nothing on their LAN can reach you through it, and a compromised device on their network has no path to you beyond that one tunnel endpoint.
  • Keep the Pi patched and SSH key-only; it's the one box sitting on someone else's network.
  • Ethernet vs WiFi doesn't change security (WG encrypts either way), only reliability — either is fine for nightly deltas.

Borg specifics

  • Borg over the tunnel is ideal: dedup means daily deltas are MBs, and borg serve --restrict-to-path on the Pi limits blast radius.
  • Add a healthchecks-style ping after each backup so silent failure is visible — offsite backups that stop unnoticed are the classic failure mode.