Phase 1 — AWS Offsite Backup (initiate ASAP)

Part of Migration Plan — InMotion to Local + AWS Offsite. This is the current active phase. Upstream: Phase 0 — Pre-flight.

Goal

Stand up an AWS-only offsite backup for .13 (and photo archive) using the existing Borg pipeline, with S3 → Glacier Deep Archive lifecycle. Protect against burn-down / single-drive loss.

Current verified state

.13: no AWS CLI, no rclone, no credentials — clean slate.
Borg managed by NixOS backup.nix (services.borgbackup.jobs.*, systemd timers, BORG_RSH wrapper). We extend this pattern.
Region: ap-southeast-2 (Sydney).

Sub-steps

1.1 AWS account + IAM (user does)

Sign up at https://aws.amazon.com (root MFA, billing, phone)
Set region to ap-southeast-2 (Sydney)
(built here) Create least-privilege IAM user backup-offsite (programmatic): policy only s3:PutObject/GetObject/ListBucket on the backup bucket. NO console, NO Admin.
Create access key for that user (store in password manager; not in plaintext on disk).

1.2 Bucket + lifecycle (built here)

Create bucket sam-offsite-backup (region ap-southeast-2), block public access, enable versioning, enable bucket key / server-side encryption (SSE-S3 or KMS).
Lifecycle rule: transition to Glacier Flexible after 30 days → Glacier Deep Archive after 90 days. (Optional: expire noncurrent versions to cap cost.)
Logging/object-lock: consider S3 Object Lock (compliance) as optional hardening — decide later.

1.3 Local tooling on `.13` (built here)

Install rclone (or awscli) via NixOS (add to backup.nix packages or environment.systemPackages).
Configure rclone remote (S3 API, access-key, region ap-southeast-2). Keep credentials in a root-owned file with 600 perms, referenced via NixOS secret pattern (mirror .borg-passphrase approach).

1.4 Offsite pipeline (built here)

Choose approach (prefer Borg → rclone → S3, keeps existing repo + dedup):

Borg to rclone remote — add a new services.borgbackup.jobs."offsite-to-aws" repo rclone:sambucket:borg/ via BORG_REPO / rclone backend. Schedule e.g. daily 07:00 (after local 04:00).
- Alternatively: keep local-only Borg, then rclone copy the local repo tarball/repo → S3. Simpler, but double-stores dedup loses their value — prefer direct Borg-to-rclone if Borg-backend rclone works on 1.4.3.
Seed first full backup (photos + site data) to Glacier DA path.
Test restore of one archive from S3 → verify read path works (critical; document).

1.5 Monitoring & log

systemd timer health check; add an alert (ntfy/apprise) on failure (mirror existing pattern).
Record everything in Migration Work Log.

Acceptance criteria

rclone lsd sam-offsite-backup: shows intended tree.
At least one acceptable test restore completed.
Cost projected < ~5 AUD/mo (photos in Glacier DA ~0.75–1.2/mo).

Rollback / safety

Offsite is additive — local Borg + rsync + archive repos remain untouched. Turning off the new job restores prior state.

See Migration Plan — InMotion to Local + AWS Offsite §9 for cost model.

3.4 KiB Raw Blame History Unescape Escape