Your 3:2:1 Selfhosted workflow for private documents. Onedrive, dropbox, google drive sync alternative
Hey y'll. I've made the mistake of uploading my private documents (tax, medical scans etc) to my google drive and I would like to move away from it. I've been thinking on how to properly do this and can't wrap my mind around. Right now I have Paperless-ngx…
Hey y'll. I've made the mistake of uploading my private documents (tax, medical scans etc) to my google drive and I would like to move away from it. I've been thinking on how to properly do this and can't wrap my mind around. Right now I have Paperless-ngx that is storing the documents in a custom folder structure on my homelab hdd PAPERLESS_FILENAME_FORMAT={{ custom_fields | get_cf_value('Country','') }}/{{ tag_list }}/{{ custom_fields | get_cf_value('University','') }}/{{ created }} - {{ title }} And then I have syncthing that syncs this to my encrypted laptop that has mirror sync with Google drive. (And then a once a week offsite backup to a NAS) So if I need to access a file remotely. I either login to google drive or I connect tailscale and access Paperless. Of course the files that are uploaded to google drive are not encrypted and with the recent news how cloud providers are scanning the cloud storages it got me scared to lose access to these documents (or that they have been used to train models) I don't want to use reverse proxy or VPS to access my homelab. I only use tailscale. Now what solution do I have? I've been thinking of doing something in between syncthing and the google drive folder on my laptop. Like to sync it to a cryptomator vault but it means that the vault has to be constantly mounted. And most importantly, how can I decrypt the files on my phone? Do I need to pay $25 for the cryptomator android app? Use a script (like the personal backup app by rathlev) to open and mount a veracrypt vault before a scheduled syncthing sync, and then wait an hour and close it. But I would still need to unlock the veracrypt on my android phone somehow. The files are already uploaded so there's no point in deleting them and re-uploading encrypted. I should be using the workflow I have now and don't overthink it. KISS What is your process if you don't have a VPS and want to have a 321 backup of your private files?
Collected discussion
Expand the replies to this comment to learn how AI was used in this post/project.
This is what i have right now. I just wonder how can I have my data in the cloud but encrypted and accessible from a phone? Plus how to sync the cloud with the local nas instance?
Thanks for an in depth response. I just wonder what happens if I need my tax return and my homelab or tailscale is down? I can't decrypt the volume that is in google drive on my phone and I don't have any other cloud backup easily accessible.
That's the gap in what I described, and it's worth closing because "tax return in an emergency" plays by different rules to the bulk backup. The tools I suggested don't tie you to the homelab the way you're picturing. restic, Kopia, rclone crypt and the rest decrypt from the passphrase, not the server. Any laptop with the client and the passphrase pulls the file straight off Drive and opens it. Homelab down doesn't matter, and tailscale down doesn't either, the encrypted files are sat on Drive, which is just the public internet. Nothing has to "phone home" to your house. The snag is the exact one you've spotted, a phone. restic and Borg have no decent mobile client, so on a phone that toolchain is no use to you stood outside the accountant's. So strip the emergency docs off from the archive. You don't need the full 3:2:1 machinery for "I need one PDF right now". Keep a small "break-glass" folder with maybe your tax return, passport, a couple of medical scans, in something a phone can open with nothing but a password. This is the one place the paid Cryptomator app actually earns its money. Its whole job is opening a vault that's sat in Drive, on the phone, with just the passphrase and no server in the loop. What you're describing is precisely what it's for, so if you do pay for it, pay for it to cover this, not the bulk stuff. If you'd rather not pay, the "break-glass" version holds up fine. A single encrypted 7-zip, or a password-protected PDF of the return, dropped in Drive. Any phone opens either with the password. It's ugly, but it's your "everything's on fire and I'm in front of my accountant" copy and it'll never let you down. Finally, please take pity on the poor guy (me) who appears to be practically incapable of composing a short, to the point, response!
You can set up a NAS or small server in the house of a relative or a friend. The further away they are the better. There you can have a fully encrypted storage and a KVM so you can manage everything yourself. PS: If you have tailscale, you can have a reverse proxy running on the same system with a local only dns.
You're trying to solve two different jobs with one pile of files, which is why it won't come out clean. Backup wants encrypted blobs you never open casually. Access wants readable files you can pull up on a phone. Different tools, and you've already built half of it. For the backup half, stop syncing to Drive and start backing up to it. restic, Kopia or Borg encrypt on your machine before anything leaves, then push to whatever cheap storage you like. Google gets a bag of encrypted chunks it can't scan or train on, and you get versions, which plain sync never gave you. It also fixes the thing you didn't ask about, syncthing will happily replicate a deletion to every copy you own. For the access half, you've already got it. Tailscale to Paperless is the answer. On a phone that's the same 2 taps as opening Drive, and nothing sensitive is sat in plaintext on someone else's disk. On Cryptomator, the Android app is a one-off paid thing and it does work, but mounting a vault permanently so a sync can write into it is the fragile part of that plan. It'll break at some point and you won't notice for a fortnight. rclone with a crypt remote does the same encrypt-before-upload job for free if you want to test the idea before paying. Your option 3 is half right. Re-uploading the old files encrypted isn't worth an evening. But leaving them there is a decision, not a default. Pull the tax and medical ones down, delete them from Drive, and let the new workflow cover everything from here.
Cryptomator mobile app is free for iOS, Android is the paid one. For your 3-2-1 gap, Trustworthy is one vault option for sensitive docs, though it's cloud based, opposite direction from what you're building.
For purely backups I'd use Zerobyte. It encrypts backups though, so you won't be able to access documents like you currently do on Google Drive
The problem isn't Paperless or Syncthing, it's that Google Drive is your only off-site copy, and it's seeing everything in plaintext. Swap that leg out. Use rclone with a crypt remote in front of an S3-compatible bucket, DigitalOcean Spaces, or Backblaze B2, doesn't matter much, so the encryption happens client-side before anything leaves your box. Google never sees the files, and you don't even need Tailscale in your homelab just to grab a tax return from a hotel's Wi-Fi, since you can hit the bucket directly with your rclone crypt config from any device. Keep the NAS as your true offline copy, and you've got your 3:2:1 without trusting a cloud provider with medical scans in the clear.