Back up with rclone

rclone is the swiss-army knife of file transfer: one CLI tool, every protocol, excellent filtering, and an optional encryption layer. If you're already comfortable with rsync but want include/exclude rules that don't hurt, checksums, or client-side encryption — this is your upgrade.

Prerequisites

• Connected to your CapyArk network
• rclone installed — rclone version (install: rclone.org/install or curl https://rclone.org/install.sh | sudo bash)

Step 1 — Configure the CapyArk remote

rclone config

Walk through the prompts:

1. n — new remote, name it capyark
2. Storage type: sftp
3. host → storage-baas_xxxxx (your storage hostname from the Connect tab)
4. user → your CapyArk username
5. key_file → path to your SSH private key (recommended), or leave blank and set a password when prompted
6. Accept defaults for the rest

Test it:

rclone lsd capyark:
rclone mkdir capyark:backup

Step 2 — First sync

rclone sync /path/to/local/data capyark:backup \
  --progress \
  --transfers 8

sync makes the destination match the source (including deletions — CapyArk’s automatic snapshots keep the history). Use rclone copy instead if you never want remote deletions.

Step 3 — Add filters

This is where rclone shines over plain rsync. Create ~/.config/rclone/backup-filter.txt:

# Exclude junk
- node_modules/**
- .git/**
- *.tmp
- .DS_Store
- Thumbs.db

# Everything else
+ **

Then:

rclone sync /path/to/local/data capyark:backup \
  --filter-from ~/.config/rclone/backup-filter.txt

Step 4 — Schedule it

/etc/systemd/system/capyark-rclone.service:

[Unit]
Description=CapyArk rclone backup

[Service]
Type=oneshot
ExecStart=/usr/bin/rclone sync /path/to/local/data capyark:backup \
  --filter-from /home/you/.config/rclone/backup-filter.txt \
  --log-file /var/log/capyark-rclone.log --log-level INFO

/etc/systemd/system/capyark-rclone.timer:

[Unit]
Description=Daily CapyArk backup

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true

[Install]
WantedBy=timers.target

systemctl enable --now capyark-rclone.timer

On Windows, schedule the same rclone sync command with Task Scheduler; on macOS, use cron or a LaunchAgent.

Optional — client-side encryption

Want file contents and names encrypted before they leave your machine? Wrap the remote in rclone’s crypt layer:

rclone config
# n → name: capyark-crypt
# Storage type: crypt
# remote: capyark:encrypted
# filename_encryption: standard
# Set a strong password (and salt) — WRITE THEM DOWN

Then back up to capyark-crypt: instead of capyark:backup:

rclone sync /path/to/local/data capyark-crypt:

The password is unrecoverable. Lose it and the data is gone — neither you nor CapyArk can decrypt it. Store it in a password manager and test a restore immediately after setup.

Useful commands

# Dry run — show what would change
rclone sync /data capyark:backup --dry-run

# Verify integrity — compare checksums of local vs remote
rclone check /data capyark:backup

# Restore a directory
rclone copy capyark:backup/photos /restore/photos --progress

# Limit bandwidth during work hours
rclone sync /data capyark:backup --bwlimit "08:00,512k 22:00,off"

# Browse remote interactively
rclone ncdu capyark:backup

Troubleshooting

couldn't connect SSH: ssh: handshake failed Check the VPN is up (tailscale status) and the hostname matches the Connect tab. If using a key, confirm the matching public key is added in Settings → SSH Keys.

Sync of many small files is slow Raise --transfers 16 --checkers 32. If it’s still slow, the per-file SFTP overhead is the bottleneck — restic packs small files and will be much faster.

sync deleted remote files I wanted to keep That’s mirror semantics. The files still exist in your ZFS snapshots — see Restore from a snapshot. Going forward, use rclone copy or add --backup-dir capyark:archive/$(date +%F).