Duplicati¶
Offsite encrypted backup of NFS data and database dumps. The third of the stack's three backup layers — see Backups for the full picture.
| Runtime | Container (Docker Swarm) |
| Tier | Apps (Important) |
| Node | swarm-core |
| Image | duplicati/duplicati:2.3.0.4-stable |
| URL | https://duplicati.lab.riversfamily.uk |
| Auth | Forward-auth (authentik@swarm) |
| Source | ansible/stacks/apps/duplicati/ |
Volumes¶
| Volume | Path | Backing | Contents |
|---|---|---|---|
duplicati_config |
/data |
Local | Duplicati's own config/job state |
| (bind, read-only) | /source/db |
NFS (db_backup_dir, default /srv/nfs/backups/db) |
Per-service database dumps from the db_backup role |
| (bind, read-only) | /source/vm |
NFS (proxmox_backup_dir, default /srv/nfs/backups/vm) |
Proxmox VM image backups from the proxmox_backup role |
These two read-only bind mounts are the only NFS-backed mounts anywhere in the core/apps tier — every other service's volumes are local, precisely so Duplicati is the one thing bridging local backup output to NFS and then offsite.
Secrets¶
| Vault variable | Delivered as | Purpose |
|---|---|---|
vault_duplicati_settings_encryption_key |
Plain env var (SETTINGS_ENCRYPTION_KEY) |
Encrypts Duplicati's own settings database |
vault_duplicati_ui_password |
Plain env var (DUPLICATI__WEBSERVICE_PASSWORD) |
Web UI login |
Neither is a Swarm secret: Duplicati reads both as plain env vars, so it needs no file-based secrets.
Gotchas¶
- The offsite destination (S3/B2/remote), schedule, and encryption passphrase for the backup job itself are configured manually in the Duplicati UI — this is not automated by Ansible.
- Currently blocked in the test deployment until
nfs_client_mountsis set so the shared NFS export is actually mounted on the managers (tracked as a deploy-time follow-up).