How to make easy encrypted backups with rclone for free

Rclone supports tons of different storage backends.
I like to use R2 on Cloudflare with their generous free tier, but you can use AWS S3, Google Cloud Storage,
Dropbox, or even FTP among others.

You will need to install rclone first:

# ubuntu
sudo apt install nmap
# arch
sudo pacman -S rclone

If you don't have your storage bucket ready, create a cloudflare account then go into the R2 section and create a new bucket.

You will also need a new R2 token.

Make sure to give it access to your bucket.

Use rclone config to configure your storage option.
Follow this instructions for R2. Find all
supported backends here if you want to use a different storage option (like your personal FTP server).

My rclone.conf looks like this after setting up R2:

[r2]
type = s3
provider = Cloudflare
access_key_id = REDACTED
secret_access_key = REDACTED
region = auto
endpoint = https://REDACTED.r2.cloudflarestorage.com

At this point we should be able to use rclone to copy files to R2. We
probably don't want our files to end up in a bucket in plain text, so lets add some encryption.

Rclone supports a couple of useful "virtual" or "wrapper" storage remotes. We
can use the crypt remote to transparently encrypt
and decrypt operations with another remote.

Drop into rclone config one more time and
follow the example configuration.
When specifying the remote, chose your previous remote and specify a bucket
and optionally a base directory for your backups. I like to use r2:archive/backups;
archive is the bucket and backups/ will be the prefix for all operations.

I chose to disable filename encryption since we will be uploading archive files and
not replicating the filesystem itself. Chose a strong password you will remember.

Now my config looks like this:

... r2 entry ...

[backup]
type = crypt
remote = r2:archive/backup
filename_encryption = off
password = REDACTED

At this point we can use rclone to upload encrypted files to your backup bucket.
Lets make some utility functions to make this easier.

I like to use the fish shell, so this is what I include in my fish config to make my
backups:

function generate_backup
    set _name "$argv[1]".tar.zst

    sudo tar \
      --create \
      --absolute-names \
      --one-file-system \
      --preserve-permissions \
      --exclude-vcs \
      --exclude-caches \
      --exclude-backups \
      --exclude-tag-all=.NOBACKUP \
      --warning=no-file-ignore \
      --sort=inode \
      --zstd \
      --file=- \
        $argv[2..-1] | \
    rclone rcat --quiet \
      backup:"$_name"

    echo completed backup $_name
end

This function will archive and zip the given files, excluding some unwanted files,
then stream it into rclone, which will encrypt and upload to our backups bucket.
The first argument will be the backup name, which will be suffixed by a timestamp.

The --exclude-tag-all=.NOBACKUP line allows you to drop a .NOBACKUP file in
any directory and the backup will ignore that whole directory.

Now you can use this function whenever you want to make a backup, for example:

# creates backup/home-(timestamp).tar.zst.bin in your bucket
# includes all contents of desktop documents and videos
generate_backup home ~/Desktop ~/Documents ~/Videos