If you’ve got a copy of the data that’s local, why are you opening up ports? Just run the backup job internally.

I'm often not at home for weeks at a time.

but man do I not trust a USB interface at all.

Trust?

I also recommend not relying on email for notifications - too unreliable. I use the healthchecks.io docker image and have it send me notifications via Pushover when something fails.

I'll look into this thanks!

If it absolutely has to be Linux (does it?)

It's just what I'm familiar with, what would you suggest?

Why SFTP? Wouldn’t SCP be enough?

SFTP seemed like the simplest thing that Restic supported

Automatic updates are risky for a device that is supposed to run always. Instead, I would recommend sending update notifications and then manually applying an update from time to time. If the device no longer boots up, you often don’t even notice it.

Risky from a perspective of it crashing? I think I'm okay with that as I would notice it erroring out when I try and push the backups