diff --git a/services/backup.sh b/services/backup.sh
index b88ddd8..8955f68 100644
--- a/services/backup.sh
+++ b/services/backup.sh
@@ -496,8 +496,89 @@ install_backup() {
             log_success "  SSH to $DR_SYNC_HOST works — spare sync will run after each backup."
         else
             log_warning "  Couldn't SSH to $DR_SYNC_HOST without a password right now."
-            log_warning "  Spare sync is saved but will fail until this works (as root, since"
-            log_warning "  the backup timer runs as root): ssh-keygen; ssh-copy-id $DR_SYNC_HOST"
+
+            # If the spare isn't reachable at all (behind NAT, no port-forward —
+            # a home box is the common case), a passwordless key won't help
+            # until there's a network path there in the first place. Check
+            # for an already-running mesh VPN first — wg-easy (this repo's
+            # own), Netbird, or Tailscale are all common, and if the
+            # operator already has any ONE of them running, pushing them
+            # toward installing a second, redundant mesh would be actively
+            # wrong. Only offer a choice when none of the three are present.
+            local _VPN_DETECTED=""
+            if [ -d "$DOCKER_DIR/wg-easy" ]; then
+                _VPN_DETECTED="wg-easy"
+            elif command -v netbird >/dev/null 2>&1 && systemctl is-active --quiet netbird 2>/dev/null; then
+                _VPN_DETECTED="Netbird"
+            elif command -v tailscale >/dev/null 2>&1 && systemctl is-active --quiet tailscaled 2>/dev/null; then
+                _VPN_DETECTED="Tailscale"
+            fi
+
+            if [ -n "$_VPN_DETECTED" ]; then
+                log_info "  Detected $_VPN_DETECTED already running — use its address for the spare box"
+                log_info "  destination above instead of the public one, if you haven't already."
+            else
+                echo ""
+                echo "    1) wg-easy — this repo's own guided WireGuard hub (chain-installs now)"
+                echo "    2) Netbird — official installer (needs a setup key from your Netbird"
+                echo "       account/self-hosted server — https://docs.netbird.io)"
+                echo "    3) Tailscale — official installer (opens an auth link to your account —"
+                echo "       https://tailscale.com)"
+                echo "    4) Skip"
+                echo ""
+                local _VPN_CHOICE=""
+                prompt_text "  Spare box not directly reachable? Set up a VPN mesh now [4]:" "4" _VPN_CHOICE
+                case "${_VPN_CHOICE:-4}" in
+                    1)
+                        if declare -F install_wg-easy >/dev/null 2>&1; then
+                            install_wg-easy
+                        else
+                            log_warning "  services/wg-easy.sh isn't loaded — run: sudo ./setup.sh wg-easy"
+                        fi
+                        ;;
+                    2)
+                        curl -fsSL https://pkgs.netbird.io/install.sh | sh \
+                            && log_success "  Netbird installed — finish setup with: netbird up --setup-key <YOUR_SETUP_KEY>" \
+                            || log_warning "  Netbird install failed — see https://docs.netbird.io/get-started/install/linux"
+                        ;;
+                    3)
+                        curl -fsSL https://tailscale.com/install.sh | sh \
+                            && log_success "  Tailscale installed — finish setup with: tailscale up" \
+                            || log_warning "  Tailscale install failed — see https://tailscale.com/docs/install/linux"
+                        ;;
+                    *) : ;;
+                esac
+            fi
+
+            local _HAVE_KEY=false
+            [ -f /root/.ssh/id_ed25519 ] || [ -f /root/.ssh/id_rsa ] && _HAVE_KEY=true
+            if [ "$_HAVE_KEY" = false ]; then
+                local _GEN_KEY=""
+                prompt_yn "  No SSH key found for root — generate one now (ssh-keygen)? (y/n):" "y" _GEN_KEY
+                if [[ "$_GEN_KEY" =~ ^[Yy]$ ]]; then
+                    ssh-keygen -t ed25519 -N "" -f /root/.ssh/id_ed25519 -q \
+                        && log_success "  Generated /root/.ssh/id_ed25519" \
+                        || log_warning "  ssh-keygen failed — generate one manually."
+                fi
+            fi
+
+            local _COPY_KEY=""
+            prompt_yn "  Run ssh-copy-id to $DR_SYNC_HOST now? (asks for its login password interactively) (y/n):" "y" _COPY_KEY
+            if [[ "$_COPY_KEY" =~ ^[Yy]$ ]]; then
+                if ssh-copy-id "$DR_SYNC_HOST"; then
+                    if ssh -o BatchMode=yes -o ConnectTimeout=5 "$DR_SYNC_HOST" true 2>/dev/null; then
+                        log_success "  SSH to $DR_SYNC_HOST now works — spare sync will run after each backup."
+                    else
+                        log_warning "  ssh-copy-id reported success but the passwordless check still failed — check manually."
+                    fi
+                else
+                    log_warning "  ssh-copy-id failed. Spare sync is saved but will fail until this works:"
+                    log_warning "    ssh-copy-id $DR_SYNC_HOST"
+                fi
+            else
+                log_warning "  Spare sync is saved but will fail until this works (as root, since"
+                log_warning "  the backup timer runs as root): ssh-copy-id $DR_SYNC_HOST"
+            fi
         fi
     fi