Off site back up at non-tech person's house reddit / selfhosted ---------------------------------------------------------------------- fm2606 · 2023-10-14 13:58 I am at my childhood home in rural central U.S. helping my mom after she had a bad fall. She finally got reliable internet through Starlink. I've been working remotely while here and have had zero issues. I plan on coming up every month or so for a few weeks, I live in FL. This got me to thinking I could set up an offsite backup here at Mom's house for my homelab home. ​ The backup would be for non-professional needs. I'm not a digital hoarder, nor do I have a lot of, if any, sensitive personal information, though I would plan on encrypting the disk. This would mainly as an exercise because I can and learning. But if I do it I still want it as reliable as possible. Since the internet is Starlink and doesn't have a static IP address, I would have to set up a VPN, which I would setup regardless if it was Starlink or not. My question is, has anyone set up a relatively reliable offsite backup system at a non-technical person's home where they won't have the ability to fix anything for sometime if something breaks? If so, what did you set up? ---------------------------------------------------------------------- siranysparechange · 2023-10-14 14:58 I have the remote box wireguard back to me and a bash script that periodically bounces the tunnel if the tunnel isn't working If the remote box has a desktop environment, rustdesk makes an excellent plan B ---------------------------------------------------------------------- joecool42069 · 2023-10-14 15:03 ipmi/ilo/idrac is a must. Don’t be that guy asking mom to go down to the basement to reboot the server. ---------------------------------------------------------------------- rickyh7 · 2023-10-14 17:10 Tailscale + pikvm + rsync. Pikvm so you can remotely manage your server including bios if you need it, Tailscale to get through starlink CGNAT complications, and rsync is just generally a great backup system that I’ve been using for years. I have exactly the same setup, parents have Starlink I built a server and put it there and just do nightly backups via rsync over Tailscale ---------------------------------------------------------------------- j0hnp0s · 2023-10-14 17:46 I have an old macmini with debian at my sister's house. She's using it for TV/streaming stuff. I have it on zerotier. My NAS connects every night, and rsyncs. That way she also gets access to stuff that she might need from my archive. I also have a small luks partition, but I don't have much stuff that are that sensitive ---------------------------------------------------------------------- WiseLordship · 2023-10-14 18:04 Two suggestions from experience: 1. You want at least two always-on redundant ways to punch out of any NAT / CGNAT situation so you can retain access to the machine. I like to have two OpenVPN instances, each dialed out to a separate server on the internet. `keepalive 25 120` config directive to detect and restart a dead tunnel. Then I can ssh into the remote box from those servers over the tunnel and configure whatever I need. Other options are ipsec, autossh tunnel, Nebula, etc. Whatever method you use, be sure it will survive periodic internet outages, DNS outages, server outages, reboots, etc. 2. Add a periodic reboot to the box. You never know what weird, impossible-to-reproduce state it'll get in that could kill your access until the next reboot. ---------------------------------------------------------------------- ma29he · 2023-10-14 20:02 I would use wireguard to make that off site machine connect to my primary home lab. The wireguard connection gives you an reproducible and fixed IP. The machine can then be remotely managed via ssh. The ssh can also be used for transmitting the data to be backuped. I would recommend `restic` as it supports end-to-end encrypting your (compressed and incremental) backups. This way the remote machine never sees unencrypted data and is not a concern in any threat model. ---------------------------------------------------------------------- bartoque · 2023-10-14 20:35 For remote backup between local nas and remote nas I use Zerotier, the virtual networking solution. No need to do anything with portforwarding on the router on either end simplifies the setup. ---------------------------------------------------------------------- phillibl · 2023-10-14 21:02 This is the way, super easy and hands off ---------------------------------------------------------------------- SelectCase · 2023-10-14 21:31 Having the remote site dial home is definitely best way to go. That completely avoids any issues with dynamic IPs on the remote side. OP, It's probably obvious, but make sure to include your parents home network security into the equation. I'd strongly recommend blocking all traffic that isn't from the VPN on the ssh port, or at least using key only ssh authentication. I'd probably get ransomware spreading to my home network from my parents place if I didn't basically quarantine any host on their network from the rest of their network. My dad's fallen for the remote support scam and I wouldn't be surprised if I learned he had a Nigerian prince pen pal. ---------------------------------------------------------------------- ma29he · 2023-10-14 21:40 The wireguard makes sure that only wireguard users can access the ssh and so on (through the wire guard IP). Everything else can stay behind a router / NAT / Firewall with no ports need to be opened to the Internet. I run such a setup myself and it is amazingly stable and resilient some of the machines managed this way I did not touch for more than three years any more! ---------------------------------------------------------------------- Haliphone · 2023-10-14 22:29 Hi, could you eli5 those for me? I googled them and got a bit lost in the jargon. ---------------------------------------------------------------------- joecool42069 · 2023-10-14 22:33 do you know what a kvm is? ---------------------------------------------------------------------- SelectCase · 2023-10-14 22:58 I didn't realize that wireguard does all the IP tables/firewall configuration automatically. That's awesome and super easy. ---------------------------------------------------------------------- jschwalbe · 2023-10-15 00:20 Not exactly your question, but I keep a small NAS at my parent's house which I connect to over WiFi whenever I'm there (every 1-2 months) for Time Machine backups (Apple's built-in backup solution). I had plans to make it work over wireguard, but this solution worked without thinking hard, so I just kept it that way. ---------------------------------------------------------------------- jschwalbe · 2023-10-15 00:22 Nope. If you're on the same wifi network as a machine that's got wireguard, you can definitely still connect to it without using wireguard (unless you've gone through the process of blocking non- wireguard traffic). ---------------------------------------------------------------------- jeopardised_beans · 2023-10-15 00:26 They are different options (some are vendor specific) for managing a computer remotely, outside of its operating system. It’s like a little additional computer that is designed to be very stable with its own network connection, that is stuck on to your main machine - with access to things like the power switch. Depending on what you use, some are CLI based, some have a web GUI that you can access. Those might have fancy features, such as being able to open a window to your main machine’s desktop (like VNC) and interact with it. Amazingly useful if you lose connection to your computer’s OS, or make a change to something like SSH that locks you out of access (don’t ask me how I know that :) ). ---------------------------------------------------------------------- BigGothKitty · 2023-10-15 01:39 I do exactly this using syncthing. It handles 99% of what you need to do. I have a low power linux box a few thousand miles from home with a large hard disk at a location I trust. It is a peer to peer service that only relies on an introduction server. Once the clients know where they are its peer to peer. The developers run a big introduction server or you can run your own if you have a machine with a static IP. Does almost all the network things automatically. Once you have it set up it will keep the folders you pair on each machine synchronized. There are a ton of options for one way vs 2 way synchronization and encryption, rate limiting, untrusted endpoints. I have it pointed at my encrypted backup drive at home. That drive only gets updated between 2-4am so any data transfers happen way off hours and don't slow the internet down at the remote location. ---------------------------------------------------------------------- xkcd__386 · 2023-10-15 02:25 if you use syncthing you don't even have to have a separate machine (assuming your mum's machine has enough disk) I back up my daughter's laptop to mine using syncthing -- she lives in a different city now, and any time both machines are on, syncthing kicks in. Just fire and forget, really once in a while she'll call me and say she just completed an important assignment that contains lots of multi-GB files so can I please keep *my* laptop on for a couple of hours, but most of the time even that is not needed ---------------------------------------------------------------------- BigGothKitty · 2023-10-15 03:05 Yep. I end up using syncthing for almost every device. The android app dumps my phone photos as soon as I get home. ---------------------------------------------------------------------- GrumpyCat79 · 2023-10-15 08:04 I have a small proxmox + proxmox backup server node at a family member's place. I have a Wireguard VPN at home already so I use wg- quick to keep it connected. The bios is set to power on after a power outage. Never had a single issue so far. The node reconnects quickly, even when my modem disconnects and my IP change ---------------------------------------------------------------------- useless_mlungu · 2023-10-15 10:16 I did this at my Mil's house. I hooked up a Pi4 to a 500gb 2.5 inch drive, plugged it into her router and the wall. The rest was kinda like you said, VPN (tailscale in my case) and I set up automated rclone crons from my NAS. Should I ever need to reboot the pi by force, MIL can just flick the power switch on and off on the wall. ---------------------------------------------------------------------- fm2606 · 2023-10-15 12:24 By "wireguard back to me" do you mean remote VPNs back to the home network? ---------------------------------------------------------------------- siranysparechange · 2023-10-15 12:30 Yes, just by creating my wg0.conf file and auto starting it with systemd so it connects on reboot ---------------------------------------------------------------------- watchdog_timer · 2023-10-15 15:46 Does synching preserve version information? In other words, if I modify or overwrite a file by mistake and the mistake gets synced, is there a way to recover the original file? ---------------------------------------------------------------------- xkcd__386 · 2023-10-16 00:35 yes, with three different strategies you can pick (but I'm not sure if they are the default -- you may have to enable it) https://docs.syncthing.net/users/versioning.html for more ---------------------------------------------------------------------- PovilasID · 2023-10-16 08:54 I mostly agree however for my needs I also host zerotier in paralele to tailscale just, so that if one goes down or I manage to misconfigure it I have a backup. If you have a domain you can also look into [cloudflared](https://github.com/cloudflare/cloudflared) this one is little easier to setup and has more UI in setting up. rsync is solid... however... look into other options depending on what you want to backup. People mention veem a lot I use restic with a couple extensions (grafan dashboards and notifications on failure) because of how efficiently it uses space. Kopia and borgomatic has their own benefits. If you are using proxmox in your servers look into proxmox backup server. ---------------------------------------------------------------------- Haliphone · 2023-10-16 22:51 Thanks