I view my photos using immich, historically I used photo prism with photosync to back them up.
My photos are stored on my nas (omv), immich is on my android and I access it through wireguard.
My nas is raidz1 with 4 drives, so it is relatively resilient. The photos are backed up to a separate external hard drive too using borgbackup.
What i’d like to do is the following: Back up my photos externally - at a family members house with a pi zero connected to a hard drive, which would be connected to their WiFi or via an ethernet cable to the router.
Ideally, the first backup should be done at home before, I don’t want to backup 100’s GB over the internet.
Would a simple wireguard tunnel be ok here? Should a different method be used?
Has anyone done such a thing? I read a lot about vps, but I don’t what the ongoing commitment in cost when I have a free option.
One of my worries is that I don’t want a compromised device on the family member’s network to compromise mine, would the wireguard tunnel be enough to secure it? Would WiFi be more secure than ethernet cable?
Yes, this works and people do exactly this — but a few things will make or break it:
Borg client-side encryption solves your trust worry. The Pi only ever sees encrypted chunks, so it doesn’t matter that it sits on a family member’s network. They can’t read a thing, and they can’t even see file names. Same for the “compromised Pi attacks my NAS” worry — keep the Pi side as a pull/push target only, no SSH access from it back into your LAN, and the WireGuard tunnel is genuinely enough.
NAT traversal is the real friction. With plain WireGuard between two home NATs you’ll be fighting dynamic IPs and CGNAT. Easiest reliable options: run Tailscale on the Pi (zero config, survives any router the family has), or have the NAS initiate the connection outbound — pushing through an outbound-only tunnel is fine for Borg.
Seed at home, then let deltas flow. Do the first full backup at home, then move the disk. Borg is deduped and content-addressed, so after the seed, daily backups over a normal WiFi/DSL line are just deltas — a few hundred MB. No VPS needed unless the family setup proves unreliable.
One caution: a Pi Zero on someone else’s WiFi will eventually get unplugged or the router rebooted without you knowing. Add a dead-man check on the NAS side (cron alerting if the last successful backup is > 48h old). “Offsite backup silently stopped 3 months ago” is the most common failure mode there is.