Post #3434093

@lattera@bsd.network Add iSCSI and Wireguard to that list and you have secure off-site backups. I have a machine in a colo that exports a zvol as an iSCSI volume via Wireguard. It uses zrepl (the only bit of the setup not in the base system) to take decaying snapshots of the volume. My NAS mounts it and puts a ZFS pool over GELI on it and uses zrepl to replicate decaying snapshots of datasets I care about to it. The remote machine never sees plaintext of the filesystem, so a compromise can’t compromise the confidentiality of the data. The local machine can’t delete the snapshots of the volume, so can’t compromise the integrity of the backups once they’ve been written.