Pull-only backup model — Granit fetches, never deletes #24

Model

Granit pulls backups from the home NAS. The NAS never connects to Granit.

NAS (source) Granit (offsite)
──────────── ────────────────
Exposes backups read-only ←── SSH's in, reads data
No credentials to Granit Writes to local SATA drive
 Never deletes, even if source
 files are removed

Security properties

• NAS compromise can't reach Granit — the NAS has no keys/credentials for Granit. All connections are initiated by Granit.
• Ransomware on NAS can't delete offsite copies — Granit only adds data, never removes it based on source state.
• Granit holds the SSH key — the NAS only needs a read-only user/share.

Implementation with rclone (current stack)

Use rclone copy (not sync) — it only adds new/changed files, never deletes:

rclone copy source:backups /mnt/backup

For versioning (keep old versions of changed files):

rclone sync source:backups /mnt/backup --backup-dir /mnt/backup/.versions/$(date +%F)

Local retention

Granit manages its own retention policy locally (e.g. delete versions older than 90 days). This runs as a local cron/timer, not triggered by the source.

Impact on other issues

• Provisioning tool (Provisioning tool — one-step setup for sender + receiver #17 ): generates SSH keypair on Granit, deploys read-only public key to NAS
• Unprivileged user (Run rclone as unprivileged backup user #20 ): the rclone process on Granit runs as a dedicated user
• Heartbeat (Heartbeat monitoring with automatic mesh revocation #21 ): still relevant — Granit reports backup status after each pull