• 0 Posts
  • 1 Comment
Joined 2 days ago
Cake day: October 17th, 2026
  • miaowoo_lw@lemmy.worldtoSelfhosted@lemmy.world•BackupEnglish
    2·
    1 day ago

    One thing worth adding about the first-sync concern: do the seed backup at home as planned (borg chunks are resumable, so a USB hand-off doesn’t waste anything), and after that the incremental over the tunnel is small — photo deltas plus new shots, usually a few hundred MB a day at most.

    On the Pi Zero side: give it a real USB disk rather than an SD-card-only repo. Borg’s repository format does a lot of random I/O, and SD cards die fast under that pattern. A Pi Zero 2 W with a USB enclosure (or a powered hub) handles repo locks and compaction fine; the original Zero is noticeably slower at borg compact.

    Also lock down repo access: dedicated SSH key restricted in authorized_keys to command="borg serve --restrict-to-path /srv/borg/...", so a compromised key from home can’t be used for anything else on the Pi. WireGuard is the right transport — no port-forwarding of borg/SSH directly, survives the family’s router rebooting, and the Pi can be firewalled to only accept the tunnel.