Friend-to-friend ZFS backups

[u/basnijholt]

Hi folks!

I love the Nix + ZFS combo and I run >10 of my machines on it. My friend is also fan of ZFS and we both have a NAS. We wanted to use each other's machines to do remote backups in a safe but simple way (zfs send | zfs receive and plain SSH). However, without giving each other any insight into what runs on the other machine and without being able to see what that other person has, not even metadata about other datasets.

I wrote about it in this blog post, the repo is here gh:basnijholt/zfs-tenant, and the docs are here.

Quick start on NixOS from the docs:

Add the flake to the host:

{
  inputs.zfs-tenant.url = "github:basnijholt/zfs-tenant";

  outputs = { nixpkgs, zfs-tenant, ... }: {
    nixosConfigurations.nas = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        zfs-tenant.nixosModules.host
        ./configuration.nix
      ];
    };
  };
}

On the host, give friend a tenant root:

services.zfs-tenant = {
  enable = true;
  tenants.joe = {
    dataset = "tank/friends/joe";
    quota = "2T";
    authorizedKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... joe-nas" ];
    allowedFrom = [ "100.64.0.12" ];  # Joe's tailnet address
  };
};

Disclaimer: I used AI to help me build it but I have high confidence on correctness, my security reviews went deep and even found a RCE in Synoid.