Server: Federated Backup

[thibaultamartin]

Nextcloud pushes for self-hosting, which is a great thing but comes with some responsibilities some inexperienced users may not have in mind. Especially, losing data is easy if your server gets wiped for any reason.

A federated backup solution could be a user-friendly alternative for the less tech-savvy users. Two users could chose to backup each other's instance. This way if user A's instance got wiped, he could still pull the backup from user B's instance and restore it, from the administrator interface. This would at least require backups encryption, and probably a 24 word seed phrase for the key.

[sunjam]

Hi, see these related feature requests:

• Issue #8459 with $5 bounty

Federated data from remote host will still be accessible from the web client while the remote host is offline. Federated share owner can allow those with remote access to keep local copies of the shared data.

• Issue #11653 with $70 bounty

Zot Protocol allows users to clone/merge/migrate user accounts across multiple physical servers. You can read about Zot/6 here in detail as it has been developed for Hubzilla and works beautifully. This would be an absolutely huge step forward for Nextcloud.

Mirroring accounts across multiple servers for faster access times
Preventing single point of failure when a user's server goes down
Promoting free speech
Decentralization

[sunjam]

I know rclone is a solid tool for backing up Nextcloud instances + generic webdav. I see an rclone webui is being developed here in react. I noticed mention of people mounting their rclone backups via webdav (see various discussions on https://forum.rclone.org)

Borg Backup is another tool that is available.

[Utopiah]

This is related to https://github.com/nextcloud/server/issues/15883 in the sense that in my humble opinion this is not a feature, this is a requirement from a GDPR standpoint but, more importantly, a moral obligation when ones promotes itself against vendor lock-in.

[sunjam]

Right now we have a pledge of moving towards compliance. See the Data Request app on Github here [1]. You can submit ideas there.

[1] https://github.com/nextcloud/data_request/issues

On Nov 3, 2019, at 11:34 PM, Gatak [e-mail] wrote:

Indeed. A NC internal backup system could be GDPR compliant, whereas external backups usually are not. For example if a user do request data removal, it should also be removed from backups.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub, or unsubscribe.

[thibaultamartin]

Indeed. A NC internal backup system could be GDPR compliant, whereas external backups usually are not. For example if a user do request data removal, it should also be removed from backups.

Some feedback from a digital rights lawyer, who had a quick look at the issue:

As long as the backup is encrypted and it's an opt-in option for the end-user, I don't see it as an issue regarding GDPR. Quite on the opposite, the GDPR requires data safety

From a more technical standpoint, using a 24 word seed phrase for the encryption key would ensure that the encryption key is not stored on the remote server but can still be reconstructed if the master instance is lost.

I won't dig further into technical details as this is far from my domain of expertise :)