Keep the app data private on a NAS and in backups

synology.md

@@ -21,7 +21,14 @@ It asks for your DSM password, which apps you want, and a folder (`/volume1/dock
 default, one folder per app). The apps show up in Container Manager under **Project**,
 where you can see their logs, stop and start them.
 
-You can turn SSH off again afterwards; you only need it to update.
+Turn SSH off again afterwards (Control Panel > Terminal & SNMP); you only need it to
+update, and an SSH login with your DSM password is the easiest way into the NAS.
+
+**Keep the `docker` folder private.** It holds every app's database, backups and setup
+code, and anyone who can open it over the network can copy them. In Control Panel >
+Shared Folder, select `docker` > **Edit**: on **Permissions**, give *administrators*
+Read/Write and every other user and group No access; on **General**, tick *Hide this
+shared folder in "My Network Places"*. Don't sync it with Synology Drive or Cloud Sync.
 
 ## Without SSH
 

updates-and-backups.md

@@ -55,12 +55,20 @@ On a Synology without SSH: Container Manager > Image, select the app's image and
 
 Each app keeps everything in the `pb_data` folder inside its own folder, and makes a nightly
 backup into `pb_data/backups`, keeping the last 7. Those stay on the same disk, so also keep
-a copy somewhere else:
-
-- **Synology:** add the `docker` folder to a **Hyper Backup** task.
-- **Other NAS:** include the apps' folders in its backup or snapshot schedule.
-- **Linux or a Pi:** copy the folder to another disk or computer from time to time, for
-  example with `rsync -a ~/selfhostit/ otherhost:backups/selfhostit/`.
+a copy somewhere else. The data is private (Flowy holds health data), so encrypt any copy
+that leaves the machine, and leave out the `tailscale` folder: it holds the machine's
+Tailscale key, which lets whoever has it join your tailnet as that machine.
+
+- **Synology:** add the apps' `pb_data` folders to a **Hyper Backup** task with
+  **client-side encryption** turned on.
+- **Other NAS:** include the apps' `pb_data` folders in its backup or snapshot schedule,
+  encrypted if it goes off the NAS.
+- **Linux or a Pi:** copy the `pb_data` folders to another disk or computer from time to
+  time, for example with `rsync -a --exclude tailscale ~/selfhostit/ otherhost:backups/selfhostit/`,
+  to an encrypted disk.
+
+Selling or throwing away the machine or its SD card? Delete the apps' folders and wipe the
+disk first; the data on it is not encrypted.
 
 To restore, stop the app (`docker compose down`), put `pb_data` back, and start it again
 (`docker compose up -d`).