Post #3434111
2026-06-27 18:48 UTC
Today, I'm thankful for the combination of these two #FreeBSD features:
geli-based storage encryptionZFS
Before I fly out to help with a family medical emergency, I'm backing up my most important bits to a geli-encrypted encrypted NVMe USB enclosure.
It's ZFS all the way down, so I can do something like:
# zpool import backups
$ zfs snapshot rpool/home/shawn@2026-06-27
$ zfs send -vp rpool/home/shawn@2026-06-27 > /backups/laptop/home-2026-06-27.zfs
Rinse and repeat for each ZFS dataset I'm interested in backing up, both for the laptop itself and for the ZFS datasets contained within the VMs on the laptop.
Replies (1)
-
@david_chisnall@infosec.exchange 2026-06-27 20:14
@lattera@bsd.network Add iSCSI and Wireguard to that list and you have secure off-site backups. I have a machine in a colo that exports a zvol as an iSCSI volume via Wireguard. It uses zrepl (the only bit of the setup not in the base system) to take decaying snapshots of the volume. My NAS mounts it and puts a ZFS pool over GELI on it and uses zrepl to replicate decaying snapshots of datasets I care about to it. The remote machine never sees plaintext of the filesystem, so a compromise can’t compromise the confidentiality of the data. The local machine can’t delete the snapshots of the volume, so can’t compromise the integrity of the backups once they’ve been written.