84 lines
2.9 KiB
Markdown
84 lines
2.9 KiB
Markdown
# Plan: Time Machine Backup via SSH Tunnel
|
|
|
|
**Date**: 2026-05-14
|
|
**Status**: Planning
|
|
|
|
## Problem
|
|
|
|
Kraken (RPi5) is in a different network (VPS via tunnel, IP 91.207.28.205:2223).
|
|
Time Machine is configured for `smb://timemachine@kraken._smb._tcp.local./TimeMachine` via mDNS — not reachable when Kraken is on a remote network.
|
|
|
|
Last backup: May 12, 2026. Backup destination is 3.98 TB quota.
|
|
|
|
## Options
|
|
|
|
### Option A: SSH Tunnel → SMB Port Forward (complex, fragile)
|
|
```bash
|
|
ssh -L 445:localhost:445 kraken@91.207.28.205 -p 2223
|
|
```
|
|
Then add TM destination: `smb://timemachine@localhost/TimeMachine`
|
|
|
|
**Problems:**
|
|
- SMB over SSH tunnel is slow for large backups
|
|
- macOS blocks port 445 forwarding without SIP disabled
|
|
- TM doesn't handle SMB reconnects well → corrupted sparsebundles
|
|
- Port 445 requires root privileges on Mac side
|
|
|
|
### Option B: Netatalk (AFP over TCP) via Tunnel (legacy, not recommended)
|
|
AFP support was removed from TM in macOS Ventura+. Not viable.
|
|
|
|
### Option C: restic/rclone to remote (not TM, but works)
|
|
Replace TM for Kraken backup with `restic`:
|
|
```bash
|
|
# On Eagle:
|
|
restic -r sftp:kraken@91.207.28.205:2223/backups/eagle backup ~/
|
|
```
|
|
Works over SSH, incremental, encrypted. But not native TM UX.
|
|
|
|
### Option D: Wireguard VPN between Eagle and Kraken (best)
|
|
- Kraken runs Wireguard server → Eagle connects as peer
|
|
- Eagle sees Kraken's SMB share at VPN IP (e.g. 10.0.0.2)
|
|
- TM configured to use VPN IP instead of mDNS
|
|
- Survives network changes, works from any location
|
|
|
|
**Setup:**
|
|
1. Install Wireguard on Kraken (Docker or host)
|
|
2. Configure Eagle as Wireguard peer
|
|
3. Expose Samba port on Kraken's VPN interface
|
|
4. Update TM destination to VPN IP
|
|
|
|
### Option E: Keep WD12-TimeMachine local + periodic rsync to Kraken
|
|
- WD12-TimeMachine (6.01 TB) is LOCAL — backups fine
|
|
- Rsync the TM sparsebundle to Kraken weekly
|
|
- Kraken = offsite copy, not real-time TM
|
|
|
|
## Recommendation
|
|
|
|
**Short term**: Do nothing — WD12 local TM is working fine (last backup May 12).
|
|
|
|
**Medium term (1-2 weeks)**: Option D (Wireguard VPN)
|
|
- Best reliability, proper TM over SMB
|
|
- Kraken already has Docker — easy to add Wireguard container
|
|
|
|
**Alternatively**: Option E (rsync TM bundle to Kraken) — simpler, less real-time
|
|
|
|
## Current Status
|
|
|
|
- WD12-TimeMachine: local, 6.01 TB, working ✅
|
|
- Kraken SMB TM: 3.98 TB, last backup May 12, NOT reachable from Eagle currently ⚠️
|
|
- Kraken network: accessible only via SSH tunnel (VPS 91.207.28.205:2223)
|
|
|
|
## Next Steps (when ready to implement)
|
|
|
|
1. Decision: Wireguard vs rsync-only
|
|
2. If Wireguard: deploy wg-easy Docker container on Kraken
|
|
3. Configure Eagle as peer (macOS Wireguard app or CLI)
|
|
4. Test SMB reach over VPN
|
|
5. Update TM destination
|
|
|
|
## Notes
|
|
|
|
- Don't try SMB over port-forward — port 445 blocked by macOS SIP on loopback
|
|
- Kraken SSH tunnel is stable (CF tunnel via cloudflared)
|
|
- TrueNAS (Taiga) also available for backup — might be better option if Taiga on local net
|