`rclone mount` an `rclone crypt` over a Cloudflare R3 backend of `rclone`? Or if it's sufficiently often "off/idle", take 3 USB HDDs (1~2 years ago I bought an iirc WD MyPassport 5TB for very similar workload) into a RAID-5 and have appropriate off-site backup that you actively check to have successfully gotten the latest daily backup's file contents (check a couple (3~5) random files as well as a few (3~5 ish) critical/database/metadata files) at least every 1~3 months.

Also, as opportunities arise like for example from a major upgrade to local storage capacity, try to fully test a backup restore emulated to "your home burned to the ground while you were at the office/on holiday" conditions every 1~3 years if you can afford to spend the bandwidth for it.

Consider burning in drives for a group-buy you do with local friends if necessary to at least get such a full restore trial every about 3 years. Try as best to consider a trial every about 5 years to be a "cost of doing business" that's not just nice to have but essential to the value proposition of the data archive storing home server.

Oh and yeah, I fully mean to let the drives go to sleep when you're not accessing them through "manual"/interactive means (exceptions are limited-time background queued work with a set override timer, and the daily backup runs, which will also unlock the drives from their regular sleep-doesn't-get-interrupted-for-no-good-reason enforcement; ofc this is all something you do only if you can and feel like you want to: just hunting down rouge accesses/wake-ups happening at odd times by setting up some minor logging of which programs/files/accesses (or at the very least _when exactly_) are causing the drives to wake up is something you could very well get away with). Also take care to ensure they get good airflow: stack them with gaps between and ideally just take a decent but low-cost 120mm fan that you just hook to 5V from USB (if you don't have a fan header laying around) and rig with some cardboard and tape to channel air across your drives. The drives want to be around 30~45 C, consider hooking the smart temperature readout to a kill switch in case of fan failure.