obsidian-vault/work/plans/time-machine-tunnel-backup.md

Plan: Time Machine Backup via SSH Tunnel

Date: 2026-05-14 Status: Planning

Problem

Kraken (RPi5) is in a different network (VPS via tunnel, IP 91.207.28.205:2223).
Time Machine is configured for smb://timemachine@kraken._smb._tcp.local./TimeMachine via mDNS — not reachable when Kraken is on a remote network.

Last backup: May 12, 2026. Backup destination is 3.98 TB quota.

Options

Option A: SSH Tunnel → SMB Port Forward (complex, fragile)

ssh -L 445:localhost:445 kraken@91.207.28.205 -p 2223

Then add TM destination: smb://timemachine@localhost/TimeMachine

Problems:

• SMB over SSH tunnel is slow for large backups
• macOS blocks port 445 forwarding without SIP disabled
• TM doesn't handle SMB reconnects well → corrupted sparsebundles
• Port 445 requires root privileges on Mac side

Option B: Netatalk (AFP over TCP) via Tunnel (legacy, not recommended)

AFP support was removed from TM in macOS Ventura+. Not viable.

Option C: restic/rclone to remote (not TM, but works)

Replace TM for Kraken backup with restic:

# On Eagle:
restic -r sftp:kraken@91.207.28.205:2223/backups/eagle backup ~/

Works over SSH, incremental, encrypted. But not native TM UX.

Option D: Wireguard VPN between Eagle and Kraken (best)

• Kraken runs Wireguard server → Eagle connects as peer
• Eagle sees Kraken's SMB share at VPN IP (e.g. 10.0.0.2)
• TM configured to use VPN IP instead of mDNS
• Survives network changes, works from any location

Setup:

1. Install Wireguard on Kraken (Docker or host)
2. Configure Eagle as Wireguard peer
3. Expose Samba port on Kraken's VPN interface
4. Update TM destination to VPN IP

Option E: Keep WD12-TimeMachine local + periodic rsync to Kraken

• WD12-TimeMachine (6.01 TB) is LOCAL — backups fine
• Rsync the TM sparsebundle to Kraken weekly
• Kraken = offsite copy, not real-time TM

Recommendation

Short term: Do nothing — WD12 local TM is working fine (last backup May 12).

Medium term (1-2 weeks): Option D (Wireguard VPN)

• Best reliability, proper TM over SMB
• Kraken already has Docker — easy to add Wireguard container

Alternatively: Option E (rsync TM bundle to Kraken) — simpler, less real-time

Current Status

• WD12-TimeMachine: local, 6.01 TB, working ✅
• Kraken SMB TM: 3.98 TB, last backup May 12, NOT reachable from Eagle currently ⚠️
• Kraken network: accessible only via SSH tunnel (VPS 91.207.28.205:2223)

Next Steps (when ready to implement)

1. Decision: Wireguard vs rsync-only
2. If Wireguard: deploy wg-easy Docker container on Kraken
3. Configure Eagle as peer (macOS Wireguard app or CLI)
4. Test SMB reach over VPN
5. Update TM destination

Notes

• Don't try SMB over port-forward — port 445 blocked by macOS SIP on loopback
• Kraken SSH tunnel is stable (CF tunnel via cloudflared)
• TrueNAS (Taiga) also available for backup — might be better option if Taiga on local net