rclone: sync versus copy, deletions, and local encryption

The one difference that matters

sync mirrors the destination exactly: delete a save locally, run sync, and the remote copy goes too. Wrong default for backups — copy leaves anything the source no longer has.

Always preview a destructive run:

rclone sync /path/to/source remote:path/to/dest --dry-run -v

--delete-before changes when deletions happen relative to the transfer, not whether they happen. copy with --delete-excluded is the middle option when exclusions should also propagate.

Emptying a target

rclone purge --dry-run gdrivecrypt:backup/containers
rclone purge gdrivecrypt:backup/containers
rclone delete gdrivecrypt:backup/containers

purge removes everything recursively including the directory; delete empties it and keeps the directory. Mirroring an empty directory with sync achieves the same as purge and does more work; --dry-run is the cheap way to be sure which you want.

Encrypting a local folder

Encryption is a remote that wraps another remote, including a local one. Two entries are needed: a plain local remote pointing at the directory that will hold ciphertext, and a crypt remote on top of it.

rclone config
  new remote → name: localcryptraw → storage: local → path: /path/to/encrypted
  new remote → name: localcrypt    → storage: crypt → remote: localcryptraw:/

The crypt remote asks for a password and a salt password. Commands through localcrypt: then encrypt on write and decrypt on read, so plaintext never exists on disk outside the source. Losing that password loses the data — no recovery path.

How tools use it

Ludusavi treats rclone as a backend and builds the command from your configuration, not a fixed one: rclone copy by default, rclone sync when mirroring is enabled, with --progress, --stats, --transfers and whatever extra arguments you configured.

The exact invocation is in its log — read it when a sync deletes something unexpected:

~/.config/ludusavi/logs/        # Settings → Cloud → enable logging, then run a backup