Best way to do secure, private phone backup/sync using omv?

Task objective:

- backup (or perhaps syncing) phone photos, contacts, calendar, 2FA, password manager to omv

Context:

- one user

- omv main use is LAN media server

- OpenWRT router

- static IP

- bluetooth/wi-fi off (WPA3 is available in phone/router but not used due to security risks. But perhaps turning it on once a day to sync would be more secure than opening ports to the entire world 24/7?)

- phone uses self-maintained wireguard vpn (deployed on my externally hosted cloud VPS 'server' - I know wireguard is peer-to-peer but you get what I mean), and is available for any device

Considerations:

- apparently usb flash drives are not a secure mediums for file transfers, neither is wi-fi, so via internet is more secure, unless perhaps, I plugin phone to server using a usb cable?

- I have no need to access to my server from outside the house (or example, to administer it or access files).

- On my previous practise server, I successfully deployed dockers nextcloud AIO, nginx pm, fail2ban, and opened ports 80, 443 (and another for nextcloud talk but could not connect the app, perhaps because I didn't forward it in npm).

- I have successfully used npm to limit incoming connections to the IP address of my wireguard server (I think I can also do this in the router). So nextcloud was able to do instant-uploads from phone to omv via my wireguard VPS, and sync's calendar and contacts.

So, functionally, above is just what I want, but...

All info sources I've seen warn of the risks of opening ports, and I've heard of un-patched longstanding vulnerabilities in nginx npm (now since patched). So I'm starting to worry and wonder if there is a better way?

Eg:

- syncthing

- headscale/tailscale - but port-forwarding?

- just wireguard - port forwarding?

Syncthing looks good due to not having to open ports, but privacy is also a desire of mine, and the public relays know which devices are talking to which. I'm not sure how much of an issue this is, but the solution is to run your own relay, which brings me back to the same problem; opening ports.

I have to laugh, I'm staring at my phone and omv server right next to each other and all I want to do is get files from one to the other. Surely I'm making this far harder than is should be? Just looking for a simple, secure, private method.

Thanks for taking the time to read this. Any advice would be greatly appreciated.

Zitat von chente

What NPM vulnerabilities are you referring to? Can you put a link?

I use Syncthing to transfer files from smartphone to server. I do this only with wifi, without using external relays. Don't trust your Wi-Fi network?

I edited my original post - as the security vulnerabilities I think have since been fixed:

See link here:

And wi-fi issues (VPNFilter virus?):

What is WPA3? Is WPA3 secure and should i use it? | Comparitech

Is WPA3 secure? This is an important question in wi-fi security after a serious vulnerability was found in Wi-fi Protected Access 2 (WPA2), the security…

www.comparitech.com

At the end of the above article the author suggests for home networks 'Stop using wi-fi: Connect to the internet via an ethernet or data (3/4G) connection at home, or use mobile data, particularly for sensitive transactions.' and 'turn off your wifi connection if not using it'.

Anyway, perhaps periodically using wi-fi would be more secure than 24/7.

Thanks everyone for your advice. That last video link was really great - I'll be watching that many times I think.

I'm probably suffering from some sort of 'medical student disease' as I learn about security practices/issues.

I think perhaps syncthing, using their relay service, might be the best for my case. I don't have to use wi-fi or open ports and data is e2e encrypted.