If you enjoyed this article, you can support the author by becoming a sponsor on Boosty.
Duplicati + Docker: automatic backups in 10 minutes#
Backups are one of the most important parts of any infrastructure.
Even in a home Homelab — and really, everywhere else too — losing data can be very costly. And it’s not just about the data itself, but also the time it takes to restore it. It’s quite possible the latter ends up being even more expensive.
I have a video on my YouTube channel about installing and configuring Proxmox Backup Server. But that’s a fairly specific solution, and not everyone runs Proxmox in their homelab.
In this article, we’ll cover:
- what Duplicati is
- how to install it on a server
- how to set up automatic backups
- how to store backups locally and in the cloud
What is Duplicati#
Duplicati is an open-source backup system that supports:
- AES-256 encryption
- deduplication
- incremental backups
- cloud storage
- a web management interface
Supported storage:
- S3
- Backblaze B2
- Google Drive
- WebDAV
- FTP / SFTP
- local disks
- NAS
This makes it a great solution for Homelab and self-hosted infrastructure, since it covers everything a typical homelabber needs.
Key features#
Among the main features, it’s probably worth highlighting:
Encryption#
All data can be encrypted client-side before being sent.
Supported:
- AES-256
- passphrase protection
This means even the cloud provider can’t read your data. In other words, you can be relatively at ease about backups in the cloud and about nobody training their AI models on your data.
Incremental backups#
Duplicati stores data in blocks.
This lets it:
- save only the changes
- reduce storage size
- speed up backups
Since the system only saves the information that actually changed, everything happens very quickly, and it’s easier for us to plan disk space usage.
Web interface#
After installation, you get a convenient web panel.
Through it you can:
- create jobs
- manage the schedule
- restore files
- check backup status
There’s not much to explain here, honestly. Of course, seasoned admins might turn up their noses — “a graphical interface, how tacky.” But don’t fall for the provocation. A GUI is fine. As long as it wasn’t drawn by a middle-schooler.
Docker compose file from the video#
I used the build (image) from linuxserver.io as the most user-friendly option for a homelab
services: # Раздел для описания всех сервисов Docker
duplicati: # Имя сервиса
image: linuxserver/duplicati:latest # Образ Docker, последняя версия Duplicati от LinuxServer
container_name: duplicati # Имя контейнера в Docker
hostname: duplicati # Имя хоста внутри контейнера
entrypoint: # Переопределение точки входа контейнера
- /init # Используется скрипт /init, предоставляемый образом LinuxServer
#ports: # Публикация портов контейнера на хосте
# - 8200:8200 # MGMT UI - интерфейс управления Duplicati будет доступен на порту 8200
#expose: # Порт, который будет виден другим контейнерам в сети Docker
# - 8200
environment: # Переменные окружения для контейнера
- PUID=0 # UID пользователя внутри контейнера (0 = root, обычно для теста/администрирования)
- PGID=1000 # GID группы внутри контейнера (должен соответствовать вашей группе на хосте)
- TZ=Europe/Moscow # Часовой пояс для контейнера
- SETTINGS_ENCRYPTION_KEY=B2NcaR2X6gwSGt # Ключ шифрования Duplicati (необходимо изменить!)
- DUPLICATI__WEBSERVICE_PASSWORD=adminadminadmin # Пароль для веб-интерфейса (изменить обязательно!)
restart: unless-stopped # Контейнер автоматически перезапустится, если он упадет, кроме явной остановки
volumes: # Монтирование директорий хоста в контейнер
- /home/stilicho/docker/duplicati/backups:/backups # Директория для хранения бэкапов
- /home/stilicho/docker/duplicati/config:/config # Конфигурация и настройки Duplicati
- /home/stilicho/docker:/source # Директория с исходными файлами для бэкапа (можно изменить)
networks: # Сеть Docker, в которой будет работать контейнер
- proxy
labels: # Метки для Traefik (обратного прокси)
- "traefik.enable=true" # Включить обработку Traefik для этого контейнера
- "traefik.docker.network=proxy" # Использовать сеть proxy для Traefik
- "traefik.http.routers.duplicati.entrypoints=web" # Входной пункт Traefik (порт 80)
- "traefik.http.routers.duplicati.rule=Host(`duplicati.stilicho.ru`)" # Домен, по которому доступен сервис
- "traefik.http.middlewares.duplicati-https-redirect.redirectscheme.scheme=https" # Перенаправление HTTP -> HTTPS
- "traefik.http.routers.duplicati.middlewares=duplicati-https-redirect" # Подключаем middleware для редиректа
- "traefik.http.routers.duplicati-secure.entrypoints=websecure" # HTTPS маршрут Traefik (порт 443)
- "traefik.http.routers.duplicati-secure.rule=Host(`duplicati.stilicho.ru`)" # Домен HTTPS
- "traefik.http.routers.duplicati-secure.tls=true" # Включаем TLS
- "traefik.http.routers.duplicati-secure.tls.certresolver=cloudflare" # Используем Cloudflare для генерации сертификата
- "traefik.http.routers.duplicati-secure.service=duplicati" # Назначаем сервис для маршрута
- "traefik.http.services.duplicati.loadbalancer.server.port=8200" # Порт сервиса внутри контейнера для Traefik
#- traefik.http.routers.duplicati.middlewares=ipwhitelist@file # (закомментировано) пример ограничения по IP
networks: # Раздел для описания сетей
proxy: # Сеть с именем proxy
external: true # Используем внешнюю сеть Docker, созданную заранее (например для Traefik)- PUID=0 means root inside the container. For production, it’s better to use an unprivileged user.
- SETTINGS_ENCRYPTION_KEY and DUPLICATI__WEBSERVICE_PASSWORD must be changed to your own values, otherwise the data and web interface are insecure.
- /source mounts the entire
/home/stilicho/docker; if you don’t need to back up everything, it’s better to narrow the path down to specific folders. - The Traefik labels handle HTTPS and redirects. If Traefik isn’t set up yet, they can be removed until the proxy is configured.
- it’s best to specify passwords and other sensitive data via a separate .env environment file
Working with the app#
Since I already have a video review, in this article I’ll only cover the key details.
After installing the app, go to the subdomain. A welcome screen will open, where you need to enter the admin password specified in the docker-compose file.
We’re met with a fairly minimalist menu with a “retina-burning” light mode. Dark mode can be enabled in the Settings section.
In the Add backup section, you can choose the action you want: create a new backup or restore one from a config file (if you have one).
Since we need to create a backup, we choose the Add new backup option.
In the menu that appears, we set the necessary parameters. If you want, you can enable encryption for the backup.
In the next two windows, we choose:
- where to store the backup
- which service to use
In the video I chose File system, since I was backing up demo files to storage mounted via fstab.
The app will offer to test the connection.
If everything’s fine, the next window lets you choose the files to back up.
In our case, we choose the source directory, since that’s what’s specified in the docker-compose file:
/home/stilicho/docker:/source # Директория с исходными файлами для бэкапа (можно изменить)Next, we set the backup schedule.
The next window lets you configure additional parameters: volume size, number of retained copies, and so on.
Once the setup is done, your backup jobs will appear in the Home section.
As I mentioned above, to keep this article from getting too long, I won’t go into detail on the restore process. It’s shown in the video review, and everything there is fairly logical and intuitive.
