I view my photos using immich, historically I used photo prism with photosync to back them up.

My photos are stored on my nas (omv), immich is on my android and I access it through wireguard.

My nas is raidz1 with 4 drives, so it is relatively resilient. The photos are backed up to a separate external hard drive too using borgbackup.

What i'd like to do is the following:
Back up my photos externally - at a family members house with a pi zero connected to a hard drive, which would be connected to their WiFi or via an ethernet cable to the router.

Ideally, the first backup should be done at home before, I don't want to backup 100's GB over the internet.

Would a simple wireguard tunnel be ok here? Should a different method be used?

Has anyone done such a thing? I read a lot about vps, but I don't what the ongoing commitment in cost when I have a free option.

One of my worries is that I don't want a compromised device on the family member's network to compromise mine, would the wireguard tunnel be enough to secure it? Would WiFi be more secure than ethernet cable?

this sounds doable. i do something similar with syncthing. it depends on the internet connection speeds. see how it goes with wireguard. between two home NAT networks you might find something lile tailscale easier to set up. wouldnt recommend doing this when youre not able to drive over there and fix things occasionally. ethernet preferable for reliable connection over wifi at the remote end. if you secure the pi well and update it it should be fine. note that you probably need to trust the remote household with your data.

note that you probably need to trust the remote household with your data

Probably not actually. Borgbackup (and any sensible encrypted backup system really), does client side encryption. So the data should be encrypted before it's even sent down the wire. The remote household shouldn't be able to access the data without the encryption key/password.

I mean, they will have to trust the remote household not to destroy the data, but that's pretty much an unavoidable limitation.

I've got your exact setup:

• running immich (and other services with valuable data) at home (on OMV!)
• backup server at family member's house
• regular backups from here to there through Wireguard tunnel with Borgbackup

AMA!

I don’t want a compromised device on the family member’s network to compromise mine

If with "mine" you mean the pi Zero, I wouldn't worry too much about that. Just configure the pi's firewall to drop all traffic from the LAN (they have no business with this device anyway), except any incoming traffic from the router on the Wireguard port.

if its on zfs, you can do zfs snapshots using send and receive, which can handle encrypted incremental snapshots which cuts down on bandwidth and without having the remote drive mounted, which I found useful for an offsite system in case someone picks it up and walks away with it.
There are also automated tools to handle it too if you don't want to write your own backup scripts, see sanoid/syncoid

Borgbackup to a Hetzner storage box is a great solution for large (> 100GB) backups.

https://www.borgbackup.org/

https://community.hetzner.com/tutorials/install-and-configure-borgbackup/

This is similar to what I do, though with Synology Hyperbackup (to Herzner S3 storage).

It gets a bit tricky tho cause Hetzners storage boxes don't support ZFS, so you can't do the normal zfs send ... | zfs recv ... routine.

I currently zfs send into a file using sshfs to the storage box, but that also doesn't feel right...