rsync over ssh (+ wireguard)

Quote from darkopi

How to do this in "safe way"?

I suppose there will be other ways. If it helps, I make remote copies with rsync through an OpenVPN connection. It is simple to configure and use.

If you want an easy way check this out.

https://hub.docker.com/r/linuxserver/wireguard

It is not OpenVPN, it is wireguard. It is a more advanced VPN system. Easier to set up and use, and with more efficient operation. Install through docker on one of the servers and access from the other.

Once the connection between two servers is established in this way, all communications between them are encrypted. You don't need anything else. You can run them as if they were on the same LAN.

Quote from darkopi

I do not have any experience whit openvpn.

A VPN connection is an encrypted communication tunnel between two computers.

One is the server, in it the service is configured and it is listened to by clients. A server certificate is exported to configure the client.

The other is the client, you need the certificate and credentials provided by the server to configure the client and be able to make the connection.

These credentials are unique and are what guarantee the privacy of communication between both. No one can decrypt the data without the certificate that you install on the client before accessing the server.

The most secure VPN connection today is Wireguard.

Here you have more information.

https://en.wikipedia.org/wiki/Virtual_private_network

https://www.wireguard.com/

Quote from chente

Once the connection between two servers is established in this way, all communications between them are encrypted. You don't need anything else. You can run them as if they were on the same LAN.

You should write a [How-To] showing how to set up Wireguard from a container. Especially:

1. How the variables in the yml should be set.
2. How to set up the tunnel once deployed.
3. How to set up a Rsync job between two machines.

Quote from Agricola

You should write a [How-To] showing

I will try to make a guide. It is easy to do. Explaining it is more difficult. See if I can make it easy to understand.

I advance you a stack that has worked for me. Explanations are missing... I don't have time now, I'll take it easy.

---
version: "2.1"
services:
  wireguard:
    image: ghcr.io/linuxserver/wireguard
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000   #change if needed
      - PGID=100    #change if needed
      - TZ=Europe/Madrid     #change if needed
      - SERVERURL=your.domain.com    #change if needed
      - SERVERPORT=51820
      - PEERS=2      #change if needed
      - PEERDNS=auto #optional
      - INTERNAL_SUBNET=10.13.13.0 #optional
      - ALLOWEDIPS=192.168.10.0/24 #change if needed
    volumes:
      - /srv/wireguard/config:/config   #change if needed
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

As for point 3, once the connection is established it is like being locally. There is not much to explain, there are many guides on that.

And done

[How-To] Install Wireguard (VPN) in docker, server mode

darkopi

In that guide you have how to configure the server. To access from another server as a client, Wireguard would have to be installed in client mode. In the page

https://hub.docker.com/r/linuxserver/wireguard

it is explained how to do this. I'm sorry but I've never done that, you'll have to develop it yourself. It doesn't seem difficult.

If you do it would be great if you posted the method.

can you post your stack? (hides sensitive information)

I would need to see your docker-compose or yml file. Publish it by pressing the code button first </>. In this way:

version: "2.1"
services:
  wireguard:
    image: ghcr.io/linuxserver/wireguard
    container_name: wireguard
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    environment:
      - PUID=1000   #should be set to the UID of your user "docker1"
      - PGID=100    #should be set to the GID of your user "docker1"
      - TZ=Europe/Madrid     #should be adjusted according to your location
      - SERVERURL=your.domain.com    #adjust your public IP or your domain
      - SERVERPORT=51820
      - PEERS=2      #adjust to the number of clients you want to configure
      - PEERDNS=auto
      - INTERNAL_SUBNET=10.13.13.0 #only change if it conflicts
      - ALLOWEDIPS=0.0.0.0/0
    volumes:
      - /path/to/appdata/config:/config   #adjust the path of your config folder
      - /lib/modules:/lib/modules
    ports:
      - 51820:51820/udp
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
    restart: unless-stopped

Quote from darkopi

What should I do to see other devices in the lan?

The stack is correct. What device do you want to access?

You should have access to your entire network. If you can't access another machine, I don't know what the reason is.