Pull server backups onto a Synology NAS with rsync over SSH

Instead of letting servers write to the NAS, have the NAS pull from them. If a server is compromised, it then has no access to the backups. 
 One-time SSH key setup 
 
 On the NAS, enable SSH (Control Panel → Terminal & SNMP). 
 Create a key for the account that runs the task:
 ssh-keygen -t ed25519 -f ~/.ssh/backup_pull -N ''
 
 
 On the server, add the public key for a backup user. Restrict it if you can, for example command="rrsync -ro /" (rrsync ships with rsync). 
 
 The script (on the NAS) 
 #!/bin/bash
set -uo pipefail
SRC=backup@<server>
DST=/volume1/<backup-share>/<server>
LOG=/volume1/<backup-share>/logs
mkdir -p "$LOG"
day=$(date +%A)
for path in /etc/httpd /var/www/html /opt; do
 rsync -a --delete -e "ssh -i ~/.ssh/backup_pull" \
 --log-file="$LOG/$(basename "$path")_$day.log" \
 "$SRC:$path/" "$DST$path/" || echo "pull of $path failed"
done
find "$LOG" -type f -name '*.log' -mtime +7 -delete
 
 
 The first line must be #!/bin/bash . Without the ! it is just a comment, and the script runs in whatever shell starts it. 
 Test folders with [ -d path ] . A bare [ path ] is always true. 
 
 Schedule 
 Control Panel → Task Scheduler → Create → Scheduled Task → User-defined script. Run it as the user that owns the key. 
 A mirror is not a backup 
 --delete makes the NAS copy an exact mirror. A file deleted or encrypted on the server disappears from the NAS on the next run. Choose one of: 
 
 Turn on Btrfs snapshots for the shared folder (Snapshot Replication); this is the easiest fix. 
 Use rsync --link-dest=<yesterday> ... into dated folders. 
 Use Hyper Backup on top of the mirror.