I use proxmox server and proxmox backup server (in a VM 🫣) to do encrypted backups.

A raspberry pi has ssh access to PBS and it rsync all the files, and then uploads them to backblaze using rclone.

https://2.5admins.com/ recommended "pull" backups, so if someone hacks your server they don't have access to your backups. If the pi is hacked it can mess with everything, but the idea is that is has a smaller attack surface (just ssh).

PS. If you rclone a lot of files to backblaze use https://rclone.org/docs/#fast-list , or else it will get expensive