Maintenance and off-site mirror on R2

Extracted from the master document on 2026-09-04. §N numbering preserved so as not to break cross-references.

40. Maintenance and off-site mirror

/usr/local/bin/borg-maintenance.sh runs entirely locally on VM 101:

prune      ← applies retention       daily 7 · weekly 4 · monthly 6 · yearly 2
   ↓
compact    ← the ONLY step that frees real space (§39.2)
   ↓
rclone sync
   ↓
Cloudflare R2 → secure:borg-docker-host

Config: /etc/borg-maintenance/borg-maintenance.env.

40.1 rclone remote chain

r2      → S3 backend (provider = Cloudflare), access to the real bucket
   ▲
   │  mounted ON TOP
   │
secure  → crypt      ← this is the one ALL the scripts use

secure encrypts the content and the file and folder names (directory_name_encryption: true): anyone with access to the bucket — Cloudflare included — cannot even enumerate what is backed up, they only see blobs with encrypted names. Zero-knowledge encryption: the remote’s two passwords (openssl rand -base64 32 each) exist only in rclone.conf and in Vaultwarden.

no_check_bucket = true
   Why: the R2 token has permissions at the OBJECT level, not for
   bucket administration. Without the flag, rclone tries to verify/create
   the bucket on every operation and fails with 403 AccessDenied.

rclone about secure: does not work because the crypt backend does not implement about — that is not a failure. Connectivity is validated like this:

sudo RCLONE_CONFIG=/etc/rclone/rclone.conf rclone lsd secure:

Why R2: it reuses the Cloudflare account the homelab already uses for DNS and Tunnel; there is no need to open a new account just for backups.