Pull server backups onto a Synology NAS with rsync over SSH

Instead of letting servers write to the NAS, have the NAS pull from them. If a server is compromised, it then has no access to the backups.

One-time SSH key setup

1. On the NAS, enable SSH (Control Panel → Terminal & SNMP).
2. Create a key for the account that runs the task:

   ssh-keygen -t ed25519 -f ~/.ssh/backup_pull -N ''
   

3. On the server, add the public key for a backup user. Restrict it if you can, for example command="rrsync -ro /" (rrsync ships with rsync).

The script (on the NAS)

#!/bin/bash
set -uo pipefail
SRC=backup@<server>
DST=/volume1/<backup-share>/<server>
LOG=/volume1/<backup-share>/logs
mkdir -p "$LOG"
day=$(date +%A)
for path in /etc/httpd /var/www/html /opt; do
  rsync -a --delete -e "ssh -i ~/.ssh/backup_pull" \
    --log-file="$LOG/$(basename "$path")_$day.log" \
    "$SRC:$path/" "$DST$path/" || echo "pull of $path failed"
done
find "$LOG" -type f -name '*.log' -mtime +7 -delete

• The first line must be #!/bin/bash. Without the ! it is just a comment, and the script runs in whatever shell starts it.
• Test folders with [ -d path ]. A bare [ path ] is always true.

Schedule

Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script. Run it as the user that owns the key.

A mirror is not a backup

--delete makes the NAS copy an exact mirror. A file deleted or encrypted on the server disappears from the NAS on the next run. Choose one of:

• Turn on Btrfs snapshots for the shared folder (Snapshot Replication); this is the easiest fix.
• Use rsync --link-dest=<yesterday> ... into dated folders.
• Use Hyper Backup on top of the mirror.