# Pull server backups onto a Synology NAS with rsync over SSH

Instead of letting servers write to the NAS, have the NAS **pull** from them. If a server is compromised, it then has no access to the backups.

## One-time SSH key setup
1. On the NAS, enable SSH (Control Panel → Terminal & SNMP).
2. Create a key for the account that runs the task:
   ```
   ssh-keygen -t ed25519 -f ~/.ssh/backup_pull -N ''
   ```
3. On the server, add the public key for a backup user. Restrict it if you can, for example `command="rrsync -ro /"` (rrsync ships with rsync).

## The script (on the NAS)
```
#!/bin/bash
set -uo pipefail
SRC=backup@<server>
DST=/volume1/<backup-share>/<server>
LOG=/volume1/<backup-share>/logs
mkdir -p "$LOG"
day=$(date +%A)
for path in /etc/httpd /var/www/html /opt; do
  rsync -a --delete -e "ssh -i ~/.ssh/backup_pull" \
    --log-file="$LOG/$(basename "$path")_$day.log" \
    "$SRC:$path/" "$DST$path/" || echo "pull of $path failed"
done
find "$LOG" -type f -name '*.log' -mtime +7 -delete
```
- The first line must be `#!/bin/bash`. Without the `!` it is just a comment, and the script runs in whatever shell starts it.
- Test folders with `[ -d path ]`. A bare `[ path ]` is always true.

## Schedule
Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script. Run it as the user that owns the key.

## A mirror is not a backup
`--delete` makes the NAS copy an exact mirror. A file deleted or encrypted on the server disappears from the NAS on the next run. Choose one of:
- Turn on **Btrfs snapshots** for the shared folder (Snapshot Replication); this is the easiest fix.
- Use `rsync --link-dest=<yesterday> ...` into dated folders.
- Use Hyper Backup on top of the mirror.