What I do is a local backup on a different disk with BorgBackup, then a copy of that local backup to a Pi at a friend’s place, with rsync.

Don’t you want to turn off the whole NAS? Of you don’t have the disks spinning, the NAS is probably useless.

Upgraded to Debian Trixie two days ago. Runs flawlessly

I use Watchtower just to notify me of the updates. So the docker socket is read-only.

I second that advice. When choosing the HDD, make sure it is NAS-grade.