I found that rclone is enough for me. One backup to locally attached external drive with rclone sync. I add --backup-dir to keep older file versions separate, which I clean up with rclone delete based on their age. I also setup remote backup to OneDrive. rclone also takes care of the encryption for this one to protect from any snooping.