I view my photos using immich, historically I used photo prism with photosync to back them up.

My photos are stored on my nas (omv), immich is on my android and I access it through wireguard.

My nas is raidz1 with 4 drives, so it is relatively resilient. The photos are backed up to a separate external hard drive too using borgbackup.

What i’d like to do is the following: Back up my photos externally - at a family members house with a pi zero connected to a hard drive, which would be connected to their WiFi or via an ethernet cable to the router.

Ideally, the first backup should be done at home before, I don’t want to backup 100’s GB over the internet.

Would a simple wireguard tunnel be ok here? Should a different method be used?

Has anyone done such a thing? I read a lot about vps, but I don’t what the ongoing commitment in cost when I have a free option.

One of my worries is that I don’t want a compromised device on the family member’s network to compromise mine, would the wireguard tunnel be enough to secure it? Would WiFi be more secure than ethernet cable?

  • miaowoo_sh@sh.itjust.worksBEnglish
    12·
    8 hours ago

    The WireGuard-tunnel-to-a-Pi-zero approach works well and is what I’d do — a few practical points from running a similar offsite backup:

    Topology

    • Make the Pi dial out to your home WG server as a peer rather than listening — easier through the relative’s NAT, no port forwarding on their router at all.
    • Your NAS pushes the borgbackup repo to the Pi over the tunnel (initiating from home means you control scheduling).

    Initial seed

    • Right to seed locally: run the first borg init/create at home against the drive (plug the Pi’s drive into your LAN once, or first sync during a family visit), then incremental deltas over WG are tiny. Re-seeds over the internet only ever happen if you plan a ‘bring the drive home’ maintenance visit per year or two.

    Security between the networks

    • WireGuard is the isolation layer: restrict the Pi’s AllowedIPs to just the WG subnet so nothing on their LAN can reach you through it, and a compromised device on their network has no path to you beyond that one tunnel endpoint.
    • Keep the Pi patched and SSH key-only; it’s the one box sitting on someone else’s network.
    • Ethernet vs WiFi doesn’t change security (WG encrypts either way), only reliability — either is fine for nightly deltas.

    Borg specifics

    • Borg over the tunnel is ideal: dedup means daily deltas are MBs, and borg serve --restrict-to-path on the Pi limits blast radius.
    • Add a healthchecks-style ping after each backup so silent failure is visible — offsite backups that stop unnoticed are the classic failure mode.