Check out Clonezilla, which is the perfect tool for the job.
robotrono
Inside and Limbo are great on theck deck. I've very much enjoyed Little Nightmares, although checkpoints are sometimes a littler further apart than I'd like. Currently working through Mass Effect which is great but taking up lots of time. With Bastion on sale for $2.99 that's another very good one.
I am pretty happy with a Dynalink WRX36 Wifi 6 AX3600 router which has a 2.5 Gbps capable WAN port and 4 * 1 Gbps ports for LAN. I replaced the vendor firmware with OpenWRT which is working well nowadays, you just have to follow the install instructions closely. It can be had for $79.
https://mullvad.net/en/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure/ is Mullvad's response to this topic. TLDR not a concern other than possibly for IOS.
Thanks for pointing out dar, out definitely has some very interesting capabilities. My backup took off choice is BorgBackup as it makes local/remote, encrypted, deduplicated backups easy and allows for mounting previous snapshots via fuse fs for easy restore.
Instead of a fire safe which will only offer some protection I would rather get two Pelican style cases. Keep your backup drive(s) in there. Use a deduplicating/encrypted backup software to create two backup sets (I highly recommend BorgBackup). Store one of the backup cases off-site (at a friend's house, in a drawer at work, ...) and occasionally rotate the two cases.
You might want to investigate vopono which allows specific applications to run in a separate network space. This you could for example run Firefox or qbittorrent in a separate virtual network that can only communicate via Mullvad VPN tunnel but not see anything outside it. This is great for desktop use. Another great option is gluetun which allows other docker containers to be bound to a VPN tunnel.