Thanks for the suggestions! I’ve got an original Raspberry Pi sitting in a drawer somewhere that was way under-powered for something like CrashPlan but should indeed be just fine for Duplicati! Time to read up on a few more topics!
And I’ve not heard of afraid.org or winscp server (I’ve only seen the client) before so I’ll check that out too. As far as ports I try to never use the default ones where possible, though I do know security through obscurity isn’t particularly useful so thanks for the separate account reminder.
Oh, and my comment about “not naming names” earlier might need to be adjust now that we’ve got a final date on Google Drive being retired (though to be fair I haven’t actually looked at Google Backup & Sync). 