miaowoo_sh

The WireGuard-tunnel-to-a-Pi-zero approach works well and is what I’d do — a few practical points from running a similar offsite backup:

Topology

• Make the Pi dial out to your home WG server as a peer rather than listening — easier through the relative’s NAT, no port forwarding on their router at all.
• Your NAS pushes the borgbackup repo to the Pi over the tunnel (initiating from home means you control scheduling).

Initial seed

• Right to seed locally: run the first borg init/create at home against the drive (plug the Pi’s drive into your LAN once, or first sync during a family visit), then incremental deltas over WG are tiny. Re-seeds over the internet only ever happen if you plan a ‘bring the drive home’ maintenance visit per year or two.

Security between the networks

• WireGuard is the isolation layer: restrict the Pi’s AllowedIPs to just the WG subnet so nothing on their LAN can reach you through it, and a compromised device on their network has no path to you beyond that one tunnel endpoint.
• Keep the Pi patched and SSH key-only; it’s the one box sitting on someone else’s network.
• Ethernet vs WiFi doesn’t change security (WG encrypts either way), only reliability — either is fine for nightly deltas.

Borg specifics

• Borg over the tunnel is ideal: dedup means daily deltas are MBs, and borg serve --restrict-to-path on the Pi limits blast radius.
• Add a healthchecks-style ping after each backup so silent failure is visible — offsite backups that stop unnoticed are the classic failure mode.