

What I’m reading is that you want site-to-site connectivity. Wireguard + possibly dynamic DNS makes this pretty easy (assuming you can open ports and configure NAT at your sites). Or you could set up some other VPN solution like OpenVPN.
There’s also tailscale (a paid service) for facilitating the wireguard setup, NAT traversal and relaying. headscale is a self hosted solution that aims to provide something similar (but more limited in scope).








I’ve finally pinned down my backup automaton:
PartOf=a customcontainers.target.Conflicts=containers.targetfor creating read only snapshots of the relevant subvolumes.Wants=borgmatic.servicewich creates a borg backup of the snapshots on a removable drive. It also startscontainers.targeton success or failure since the containers are not required to be stopped anymore.rclone synced to an S3 compatible storage.What I’m not super happy about is the starting of
containers.targetvia the systemd unit’sOnSuccess=mechanism but I couldn’t find an elegant way of stopping the target while the snapshots were being created and then restarting the target through the other dependency mechanisms.I also realize it’s a bit fragile, since subsequent backup steps are started even if previous steps fail. But in the worst case that should just lead to either no data being written (if the mount is missing) or backing up the same data twice (not a problem due to deduplication).