danbru1989

Backups between both Unraid servers have been going well for several days. Duplicacy is great...nice UI and reliable from my experience on other setups.
 
My final setup and what I learned:
 
Goal:
Get off B2 to save on expenses. Replace B2 with two Unraid servers backing up to each other in separate geographical locations (home & office). I wanted each server to be running the Duplicacy app to manage the backups.
 
Duplicacy can do backups to many cloud storage services. One option is to a sFTP server...such as our own Unraid server. If you're not familiar with sFTP, it is basically FTP through SSH.
 
Solution:
I configured a server-to-server Wireguard tunnel between the two servers so sFTP could be used without exposing each server's SSH to the internet. Once I verified (via server terminals) that ping and SSH connections were possible between servers, I knew that things were good and I configured Duplicacy for the sFTP backups. The backups have been running great.
 
Steps:
Install the DuckDNS app and set up FQDNs for access to each of your servers through the web. (used for the Wireguard endpoints) Setup Wireguard VPN tunnel between servers. (see screenshots) Forward Wireguard ports to your servers at each location. Test Wireguard tunnel is working by pinging and SSHing both directions by using each server's terminal. Install the Duplicacy app on each server. Set up Duplicacy storage locations. Enter IP address, user, password, and / in the Directory field so you can navigate from the top level. Click the Folder icon and select a folder in /mnt/user/ that you want to designate as the Storage location. Sep up Duplicacy backups and schedules. Run initial backups.  
 
Tip 1:
Use FQDN for your Wireguard endpoints so your servers can find each other if your public IP address changes. Try DuckDNS if you aren't set up already with a FQDN to your server already.
 
Tip 2:
What's the difference between all the different Wireguard configurations? (Remote access to Server, Remote access to LAN, Server to Server, etc...) It all has to do with the "Peer Allowed IPs" setting in Wireguard. For example, if ONLY each servers IPs are allowed, then you have a "Server to Server" configuration.
 
Tip 3:
You could do sFTP backups without tunneling through Wireguard, but then you will begin to experience hacking attempts as soon as you open port 22 for allowing the SSH (sFTP) connections between your servers. Exposing SSH is highly discouraged because it is only a simple user/password wall between your server and the internet. Eventually, your password can be guessed by bots. For this reason, connect your SSH (sFTP) through Wireguard.