OneDrive Offsite Recovery Bundle (How-To)

Outcome

Create a compact, encrypted offsite recovery bundle in OneDrive that stays under a defined size cap and supports full homelab recovery after catastrophic loss.

Audience And Scope

This guide is for homelab operators who already have local backups and want a third, compressed offsite tier in OneDrive. It does not replace Hyper Backup or Kopia; it complements them.

Prerequisites

• Local backups already healthy (Hyper Backup and/or Kopia).
• OneDrive account with at least 750 GB free.
• Encryption passphrases stored in a secrets manager.
• Docker available on the backup host (or a machine with rclone installed).

Assumptions

• Offsite bundles are stored in encrypted 7z archives.
• Redownloadable content (media, model weights, caches) is excluded.
• Source code lives in GitHub; do not duplicate it in the offsite bundle.

Step 1: Define The Offsite Bundle

Organize the offsite payload into four bundles: production recovery, staging recovery, homelab recovery, and private records (encrypted separately).

OD-HASMASTER-PROD
OD-HASMASTER-STAGING
OD-HOMELAB-RECOVERY
OD-PRIVATE-RECORDS-ENCRYPTED

Step 2: Build The Bundles

Use 7z for encryption, compression, and split volumes. Split volumes help keep OneDrive uploads reliable.

7z a -t7z -mx=7 -mhe=on -p OD-HASMASTER-PROD.7z /path/to/hasmaster-prod
7z a -t7z -mx=7 -mhe=on -p OD-HASMASTER-STAGING.7z /path/to/hasmaster-staging
7z a -t7z -mx=7 -mhe=on -p OD-HOMELAB-RECOVERY.7z /path/to/homelab-recovery
7z a -t7z -mx=7 -mhe=on -p -v50g OD-PRIVATE-RECORDS-ENCRYPTED.7z /path/to/private-records

Step 3: Configure OneDrive In Rclone

On a headless host, use manual auth (no auto config). If you are using Docker, run rclone with host networking for the OAuth callback.

docker run --rm -it --network host rclone/rclone authorize "onedrive" "{\"drive_type\":\"personal\"}"

Then create two remotes: a raw OneDrive remote and a crypt remote on top of it.

rclone config
# new remote: onedrive_raw (type onedrive)
# new remote: onedrive_crypt (type crypt, remote onedrive_raw:HomelabOffsite)

Step 4: Upload The Offsite Bundles

rclone copy /path/to/offsite-staging onedrive_crypt:2026-04-09

Validation Checklist

• Remote listing shows all bundle files including private split parts.
• At least one bundle can be listed locally with 7z.
• Encryption passphrases are stored in the secrets manager.

Troubleshooting And Rollback

• If OAuth hangs, re-run auth with host networking and ensure the browser is on the same host.
• If upload is slow, reduce transfers and resume later; rclone will skip completed parts.
• If any private part is missing, re-run the private upload only and revalidate the listing.