[mercurialuser]

I've been thinking about this very problem recently.

My solution for an air-gapped backup is a linux server with no exposed ports, no daemons running.

A cron job starts a scp that copies data into a directory named as the date.

If you want you can expand using zfs with snapshots, compress, deduplicate.

Or if you have the money, buy a data domain or similar appliance and set it with immutable backups (nobody can delete them) and double password for any destructive operations. You can set it up as a tape with fiber channel or with ddboost, other ways to create a air gap