Self-managed Kopia to Backblaze B2 with Object Lock for NAS irreplaceable-data backup
Date: 2026-06-28 Status: Accepted Decision: hl-gww0 Deciders: Sean Brandt
Context
Section titled “Context”The TrueNAS-native rclone cloud-sync to B2 was failing chronically (last_run=null, stored unencrypted, 7.5 TiB over-scoped including 5.5 TiB of Acronis images), and the four TrueCloud→Storj tasks are disabled (Storj exit). The NAS holds ~2.3 TiB of irreplaceable personal data (family photos/video, documents, business data) with no reliable, encrypted, restore-verified offsite copy.
Decision
Section titled “Decision”Adopt a self-managed Kopia instance backing up to Backblaze B2 via Kopia’s S3-compatible endpoint, with client-side encryption, content-addressable dedup, zstd compression, and Object-Lock immutability. Retire the rclone task and the Storj tasks after a verified restore.
Rationale
Section titled “Rationale”- Kopia gives client-side encryption (B2 holds only ciphertext), block-level dedup (folds the heavy media duplication so cost tracks unique data, not raw tree size), and verifiable restores — none of which the rclone file-tree push provided.
- The S3-compatible endpoint (not the native
b2provider) is required for Object Lock and matches the existingrouter-kopia-backuprepository create s3shape. - Self-managed (not the TrueCloud wrapper) gives visibility and control; TrueCloud errored when adding B2 credentials.
Alternatives Considered
Section titled “Alternatives Considered”- rclone file-tree push (rejected): no encryption, no dedup, no verified restore — the failing status quo.
- TrueCloud → Storj/B2 wrapper (rejected): opaque, errored on B2 creds, and Storj is being exited.
- Native Kopia
b2provider (rejected): does not support Object Lock; the command is deprecated.
Consequences
Section titled “Consequences”- Positive: encrypted, deduplicated, immutable, restore-verified offsite copy at ~$12–13/month for ~2 TiB.
- Negative: a new role and operational surface;
repo_passwordbecomes a critical irrecoverable secret (mitigated by Vault storage plus an offline copy). - Neutral: builds additively on the hl-36m6 nas-support sandbox.