I want do regular, automated backups to a raspberry pi in my homenetwork. It is sufficient to do backups, when at home.

Every singe guide I read on 'how to do automated backups' tells me to put a passwordless ssh-key on my pi. I don't want to do this, because anyone with access to my pc, would have access to my backups which completely annihilates one purpose of backups.

My current solution is a password protected ssh-key and a rsync script. It took some time to make it work, but now I am prompted for the password as soon as I login at my home network, followed by a backup.

Now I want to use restic since I need some type of versioned backup. Also I want to backup other devices as well. The restic guide, again tells me to use a passwordless ssh-key.

Now, I had the idea to do it the other way around. I.e. my (offline) pi can ssh into my laptop without password (but resticted to resric use). I could run some systemd.timer with a script that checks if my laptop is reachable and start a backup, if this is the case.

However, this seems quite hacky and I am convinced that this is some common szenario. But I can't find any guides for it.

Can you point me into a general direction? Even some terminology would help, so I can find more information on what I want to do!