So quick update, my HDD definitely died, and I gave up on it… It's still plugged onto my computer, "just in case", but I doubt I'll ever retrieve my data.

In reaction to this, I finally automated my backup system, which involves the following:

• safe - to store API tokens, private keys, passwords, …
  
• dedup - encrypted + compressed deduplicating snapshoting system
  
• drist - automated configuration (similar to ansible/terraform)
  
• rclone - rsync for "online clouds" (used for backblaze)
  
• tarsnap - backup my servers' configuration (automated via cron)
  
• backblaze - cheapest online storage provider (B2 storage)
  

All backups are done from within "cron", and I'll receive an email if any command produce an output (basically, meaning an error).

I configure my servers using drist. It also configure the backup system, by pushing the tarsnap private key on each server, as well as the list of directories/files to back up. I try to only backup what I really need, so I don't have to skim through a huge tarball and guess which file I need or not in case of recover.
These backups are done every week from within /etc/weekly.local, so I get a report whenever they run. I trust tarsnap on the topic of encryption, so I don't bother encrypting the data before sending it to their servers.

For my personal computer, I use backblaze storage, which is not encrypted. Tarsnap can be expensive when you have lots of data, so I decided on keeping it ONLY for config files (a few MB at most).
On backblaze I have 3 buckets: one for my password store, one for the drist configs, and the last one for my data (pics, videos, …).

As I used safe, all my passwords are stored encrypted on disk, so I just upload them as-is. For drist, I want to store it encrypted, and possibly version it. The best way to do this is using dedup, which basically deduplicate data, and store "snapshot" archives after encrypting and compressing it. The dedup key used to encrypt the repo is obviously stored in the safe I mentioned earlier :)
Then, I push the whole dedup repo on backblaze using rclone, knowing that my data is safe. I do the same for my other data (dedup + backblaze).

All I need now is a way to practice recovery !