Can sanoid encrypt backups using only a key on the source?

OpenZFS Sanoid
1

I’m new to Sanoid and pretty new to ZFS.

I’m trying to figure out if I can use sanoid to manage backups of a pile of datasets from my proxmox hosts. The source pools and datasets are all unencrypted. I would like the destination snapshots (a remote host) to all be encrypted at the source, so the encryption key never touches the destination. Is this possible with sanoid?

I guess a simple option would be to create an encrypted root on the destination. If I do that instead, what are best practices for managing the encryption key? I am looking at using rsync.net and would like to not have to trust the remote end by default.

2

Create an encrypted dataset on the local machine, sync unencrypted dataset into it, then sync the (now locally) encrypted dataset over to the remote machine using a raw send with -w.

Tradeoff is you’ve now got two copies of the data locally - one encrypted, one not. But at least the encryption is happening locally, and you can raw send the encrypted dataset and snapshots over to the remote/untrusted host.

3

Thanks!
I’m really trying to avoid a local backup if I can. My mental model for backups are things like Duplicati, Duplicity, borg, restic, etc. Where the backup is remote-only, encrypted on client as it is sent, and incremental.