Use Borg (or another incremental backup program) alongside a cloud access tool
Consider using a combination of utilities that each do a part of what you want, instead of a single giant program that would do all of this. You could essentially get away with 2 programs: the "cloud access layer" and Borg (if this is what you prefer). I think the following setup would (mostly) do what you need:
Cloud storage service recommendation
Try Amazon Cloud Drive. It's quite cheap (I think about $55/year) and it works all right for me. They have a 3-month trial I believe, and you pay on a yearly basis with unlimited storage (to the extent that people store 10s of terabytes without issues). There are also several other unlimited storage services that are affordable, so please check out /r/DataHoarder on Reddit for further recommendations.
Connecting to the cloud storage from your computer
rclone allows you to use a variety of cloud storage services (including Amazon Cloud Drive) from a single interface. There is another utility with similar features,
acd_cli, which only supports Amazon Cloud Drive. Both support managing your storage from the command line (upload, download, list files), and to various degrees as a mounted filesystem.
Accessing your cloud storage as a mounted filesystem
This can be quite neat, since you can browse the contents of your cloud drive as it were a locally mounted filesystem. Both
acd_cli support FUSE-based mounting of the cloud drive in a directory on your computer.
- Read-only access works quite well, although
acd_cli is a bit faster since it minimises round-tripping to the cloud drive service, something
rclone can't do at the moment.
- Read-write support exists, but is somewhat unreliable due to the nature of cloud services and their internal implementation.
If in your tests Borg (or whichever incremental backup solution you choose) works well with FUSE mounts set to read-write, that's great. If you have any issues with that, maybe your backup tool can export its incremental backup as an archive file, which you can then upload via the
acd_cli command line.
You can pick any number of the below, but one layer of strong encryption is sufficient. I recommend not using more than one layer, as it adds additional complexity in case something breaks and/or if you need to recover data (I'm speaking from experience, even one layer is painful enough to handle there).
rclone supports adding an additional file-level encryption layer on top of any cloud storage, with or without filename encryption. This may be the simplest option, and it's what I have picked personally for now.
acd_cli may have (or had) something like this, but I couldn't find any conclusive information online. Some
acd_cli tutorials online refer to using it together with
EncFS, which a recent security audit found to be insecure.
BorgBackup seems to have some sort of encryption built-in, but I cannot comment on whether it's strong or not as I haven't used it.
File-based encryption layer is another option. If you choose to set up your cloud drive as a FUSE mount, using
eCryptFS on top of that should be OK. There is a different piece of software called
CryFS, but I haven't looked into it in detail. Do NOT use encfs, as I mentioned before, it was found to be weak.
- BorgBackup appears to have an option to use compression, so that would appear to be the easiest option if you decide to go with that.
- If you go with a different application which supports compression, try to make sure it has 'xz' or LZMA2 compression, as these have a really good compression ratio (although they may be too much for really weak machines).
- If you go with a different application that does not support compression, I recommend compressing its backup snapshot files into a
.7z archives before uploading them to the cloud.
I apologise if this doesn't meet your needs, but please let me know via comments if you have any questions (also thanks for pointing me at Borg, I may try it out).