Moving my off-site backup from B2 to a Hetzner Storage Box
My NAS runs borgmatic into a local borg repo, and a TrueNAS cloud sync task pushed that repo to Backblaze B2 for about $2 a month. When I checked what was in it, the Longhorn backups, Forgejo’s repos, the TrueNAS config and my desktop were all missing.
Hetzner instead of B2
A BX11 Storage Box is €3.87 a month for 1 TB, in the EU, and runs borg itself, so borgmatic writes to it over SSH as a second repository next to the local one. I moved borgmatic to a custom compose app on TrueNAS declared in my homelab repo. A generator turns it into a backup doc, so it is easy to check what is backed up.
My desktop still backs up to the NAS over the LAN, and the NAS uploads the desktop’s borg repo off site as one more source.
Verification
After each run borgmatic pushes a success timestamp, the archive count and the Storage Box usage to VictoriaMetrics. Alerts fire on a missed night, on archives disappearing while backups still succeed, and at 90% full Hetzner Storage Box. The weekly repository check runs on Hetzner’s side, a monthly spot check reads back 1% of the repo, and the full data check runs quarterly.
Disaster Recovery
My password store lives on the cluster, backed up to the NAS. In case of disaster it would leave the archive’s keys inside the archive.
So I made three LUKS USB sticks, each with a passphrase and YubiKey slots enrolled. A script fills them with the borg passphrase, the key exports, a separate SSH key for the Storage Box, its pinned host key, the borgmatic image, a standalone borg binary and the runbook. A script on the stick opens a borg shell against the repo at Hetzner.