# Plan: Time Machine Backup via SSH Tunnel

**Date**: 2026-05-14
**Status**: Planning

## Problem

Kraken (RPi5) is in a different network (VPS via tunnel, IP 91.207.28.205:2223).  
Time Machine is configured for `smb://timemachine@kraken._smb._tcp.local./TimeMachine` via mDNS — not reachable when Kraken is on a remote network.

Last backup: May 12, 2026. Backup destination is 3.98 TB quota.

## Options

### Option A: SSH Tunnel → SMB Port Forward (complex, fragile)
```bash
ssh -L 445:localhost:445 kraken@91.207.28.205 -p 2223
```
Then add TM destination: `smb://timemachine@localhost/TimeMachine`

**Problems:**
- SMB over SSH tunnel is slow for large backups
- macOS blocks port 445 forwarding without SIP disabled
- TM doesn't handle SMB reconnects well → corrupted sparsebundles
- Port 445 requires root privileges on Mac side

### Option B: Netatalk (AFP over TCP) via Tunnel (legacy, not recommended)
AFP support was removed from TM in macOS Ventura+. Not viable.

### Option C: restic/rclone to remote (not TM, but works)
Replace TM for Kraken backup with `restic`:
```bash
# On Eagle:
restic -r sftp:kraken@91.207.28.205:2223/backups/eagle backup ~/
```
Works over SSH, incremental, encrypted. But not native TM UX.

### Option D: Wireguard VPN between Eagle and Kraken (best)
- Kraken runs Wireguard server → Eagle connects as peer
- Eagle sees Kraken's SMB share at VPN IP (e.g. 10.0.0.2)
- TM configured to use VPN IP instead of mDNS
- Survives network changes, works from any location

**Setup:**
1. Install Wireguard on Kraken (Docker or host)
2. Configure Eagle as Wireguard peer
3. Expose Samba port on Kraken's VPN interface
4. Update TM destination to VPN IP

### Option E: Keep WD12-TimeMachine local + periodic rsync to Kraken
- WD12-TimeMachine (6.01 TB) is LOCAL — backups fine
- Rsync the TM sparsebundle to Kraken weekly
- Kraken = offsite copy, not real-time TM

## Recommendation

**Short term**: Do nothing — WD12 local TM is working fine (last backup May 12).

**Medium term (1-2 weeks)**: Option D (Wireguard VPN)
- Best reliability, proper TM over SMB
- Kraken already has Docker — easy to add Wireguard container

**Alternatively**: Option E (rsync TM bundle to Kraken) — simpler, less real-time

## Current Status

- WD12-TimeMachine: local, 6.01 TB, working ✅
- Kraken SMB TM: 3.98 TB, last backup May 12, NOT reachable from Eagle currently ⚠️
- Kraken network: accessible only via SSH tunnel (VPS 91.207.28.205:2223)

## Next Steps (when ready to implement)

1. Decision: Wireguard vs rsync-only
2. If Wireguard: deploy wg-easy Docker container on Kraken
3. Configure Eagle as peer (macOS Wireguard app or CLI)
4. Test SMB reach over VPN
5. Update TM destination

## Notes

- Don't try SMB over port-forward — port 445 blocked by macOS SIP on loopback
- Kraken SSH tunnel is stable (CF tunnel via cloudflared)
- TrueNAS (Taiga) also available for backup — might be better option if Taiga on local net