I currently use Borg for all my backups. To have a remote backup I placed my old Synology NAS at a family member and connected it to tailscale (via a tailscale docker container). That way I could also can do Borg backups to that remote NAS.
Though I have problems with the stability of the tailscale connection from the NAS. And honestly, I’m a bit tired to fix these problems.
I would like to have a self hosted backup solution, that can reach the synology NAS. I would like to avoid port forwarding at my family members network (for obvious reasons). I have a VPS in the internet that I can use for a common self hosted contact point (like I setup headscale there instead of using official Tailscale servers).
What would be your way for handling these remote backups?
The thing is, if you don’t wish to port-forward on Legacy IP nor open firewall ports for IPv6, then the only other option is to reach out to some sort of relay server. But whether your own VPS fulfils that role or you use Tailscale’s DERP/TURN relays, the same class of latency and bandwidth issues will still erupt. So you’d still have to debug them, although you presumably would have better visibility into diagnosing issues with your VPS relay.
Generally speaking, if Tailscale isn’t working for you, then all other solutions will increase in complexity, not decrease.
Answering the ultimate question, I operate and secure my SSH server, with port 22 open only for IPv6 inbound. There’s no NAT, so I don’t have to deal with debugging odd port mangling. The SSH server only allows key auth, and all password attempts are logged and blocked, because there can’t be any legitimate traffic like that. On this SSH server would be my mounts for backups.
Mhh, you are probably right. I’m really hesitant to invest more time into troubleshooting tailscale. My own tailscale connections at home are stable, and for troubleshooting at my family member I always have to drive and setup my notebook there.
Maybe I could try to setup wireguard directly in the fritzbox router at my family member. That might need less maintenance as running tailscale in a docker container, as it would remove the wireguard connection out of the NAS itself.
Opening a port directly gives me kind of an ick, because I don’t want to fiddle too much with the family members network. If something happens with it, I will be the one troubleshooting it, and I don’t need more work currently.