Deployment guide

Duplicati

Overview

Duplicati is free, open source backup software with a modern web interface. It compresses your files, encrypts them with AES-256 on the machine before upload, and deduplicates them so that each run stores only the blocks that changed. Backups can go to a local folder, a network share or a wide range of cloud storage providers. Because encryption happens before upload, the destination only ever sees encrypted blocks.

This SecureAnyCloud image installs the pinned Duplicati 2.3.0.4 stable release, runs its server under systemd, and fronts the web UI with an nginx reverse proxy that terminates HTTPS. The scheduler, retention rules, backup jobs and a file-by-file restore browser are all driven from the web UI. The web UI and REST API require a password generated on the first boot of every VM, and a per-VM key encrypts the server configuration database, so stored destination credentials and backup passphrases are protected at rest.

What you get:

Duplicati 2.3.0.4 running as the duplicati systemd service (self contained .NET 10 build)
The Duplicati web UI and REST API bound to loopback 127.0.0.1:8200, never exposed directly
An nginx reverse proxy terminating TLS on :443 with a per-VM self-signed certificate, and :80 redirecting to HTTPS
A unique web UI password generated on first boot, so no shared credential ships in the image
A per-VM settings encryption key so the server configuration database is encrypted at rest
An unauthenticated /healthz endpoint for Azure Load Balancer health probes
The duplicati-cli command line tool for scripted backups, restores and verification
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting size. Duplicati is light on resources, but large backup sets benefit from more memory.

In the network security group (NSG), allow inbound 22/tcp from your management network and 443/tcp for the web UI. Port 80/tcp is optional and only redirects to HTTPS. The UI uses a self-signed per-VM certificate. For production, put your own domain and a CA-signed certificate or a reverse proxy in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Duplicati by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:duplicati-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name duplicati \
  --image sac1647283583153:duplicati-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name duplicati --port 443 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active duplicati nginx

Both services report active. The Duplicati server serves the web UI and REST API only on the loopback connector 127.0.0.1:8200. nginx fronts it on port 443 with TLS and redirects port 80 to HTTPS, so the nginx TLS proxy is the only way in.

Step 5 - Retrieve your web UI password

Duplicati protects its web UI and REST API with a login password. Your VM generates a unique password on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/duplicati-credentials.txt

The file contains DUPLICATI_URL, the address to open in a browser, and DUPLICATI_PASSWORD, the generated login password. The password is set only in the per-VM options file /etc/default/duplicati (mode 0600), so no shared password ships in the image. Store it somewhere safe.

Step 6 - Confirm the health endpoint

Query the unauthenticated health endpoint that nginx serves for load balancers and probes:

curl -sk https://localhost/healthz

The endpoint returns ok. It never requires authentication, so it is safe to use as an Azure Load Balancer health probe. A plain request to port 80 returns 301 and redirects to HTTPS.

Step 7 - Confirm authentication is enforced

Because a password is set on first boot, an unauthenticated request to the REST API returns HTTP 401, so nobody reaches your backups without it. The commands below read the per-VM password from the credentials file and show that an unauthenticated call is rejected. They then log in to obtain a token and show that an authenticated call succeeds:

PW=$(sudo grep '^DUPLICATI_PASSWORD=' /root/duplicati-credentials.txt | cut -d= -f2-)
echo "unauth: $(curl -sk -o /dev/null -w '%{http_code}' https://localhost/api/v1/backups)"
TOKEN=$(curl -sk -X POST https://localhost/api/v1/auth/login \
  -H 'Content-Type: application/json' \
  -d "{\"Password\":\"$PW\",\"RememberMe\":false}" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["AccessToken"])')
echo "authed: $(curl -sk -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $TOKEN" https://localhost/api/v1/backups)"

The output is unauth: 401 followed by authed: 200. The login returns a signed JSON Web Token that authorizes every subsequent API call.

Step 8 - Sign in to the web UI

Browse to https://<vm-public-ip>/. The certificate is self-signed and unique to your VM, so your browser shows a certificate warning the first time. Accept it to continue, or install the certificate from /etc/nginx/tls/duplicati.crt to trust it.

At the password prompt, enter the password from Step 5 and select Login.

Step 9 - The dashboard

After you sign in, Duplicati opens on the Home dashboard. The left navigation offers Add backup, Restore, Destinations and Settings.

The main area lists your backup jobs with their last run time, duration, source and destination sizes, and number of stored versions.

Step 10 - Create a backup

Select Add backup, then Add a new backup, and step through the wizard.

Give the backup a name and a strong passphrase. Duplicati encrypts everything with this passphrase before upload. Pick a destination, such as a local folder, an SMB or SFTP share, S3, Azure Blob Storage, Backblaze B2, Google Drive and many more. Select the source folders to protect, and set an optional schedule and retention policy.

Step 11 - Restore files

Select Restore to recover data. Duplicati lists your configured backups. Pick one and choose Restore to browse it by version and select the files or folders to bring back.

To recover from a destination on a machine that has no local configuration, use Direct restore from backup files. This is the option you need in a disaster recovery scenario.

Step 12 - Verify a backup and restore from the command line

The image includes duplicati-cli, so you can script and verify backups without the web UI. The commands below back up a folder to a local destination, encrypted with a passphrase. They then restore it to a new directory so you can confirm the restored file is identical:

sudo duplicati-cli backup file:///tmp/dr-dest /etc/hostname --passphrase='choose-a-strong-passphrase' sudo duplicati-cli restore file:///tmp/dr-dest '*' --restore-path=/tmp/dr-out --passphrase='choose-a-strong-passphrase'

Duplicati reports Backup completed successfully! and then Restored 1 (...) files. This round trip shows that your encrypted backup can be read back and recovered end to end.

Maintenance

Password: the web UI password is set on first boot and stored in /etc/default/duplicati as --webservice-password inside DAEMON_OPTS. To change it, edit that file (as root) and run sudo systemctl restart duplicati.
Settings encryption: the server configuration database is encrypted with a per-VM key held in /etc/default/duplicati (SETTINGS_ENCRYPTION_KEY), which protects the destination credentials and passphrases you store in Duplicati. Keep a copy of this file if you need to recover the configuration on another machine.
Backup destinations: Duplicati supports local folders, SMB and SFTP, S3 compatible object storage, Azure Blob Storage, Backblaze B2, Google Drive, and many more; add them under Destinations or when creating a backup.
Retention: set keep rules per backup (keep a number of versions, or a smart retention schedule) in the backup's options so old versions are pruned automatically.
TLS: the UI is served over HTTPS with a self-signed per-VM certificate at /etc/nginx/tls/duplicati.crt. For production, replace it with a CA-signed certificate for your own domain, or place a reverse proxy in front.
Upgrades: Duplicati is installed from the official Debian package; to upgrade, download a newer stable release, verify its checksum, install it with apt, and restart the service. Your backup jobs and history are preserved in /var/lib/duplicati.
Security patches: unattended-upgrades remains enabled so the OS continues to receive security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Duplicati on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

Duplicati is a free, open-source backup application. It makes encrypted, deduplicated, incremental backups of your files and sends them to local folders, network shares or a wide range of cloud storage providers. It encrypts every backup with AES-256 on the client before anything leaves the machine, then uploads only changed blocks.

This image runs Duplicati as a systemd service behind an nginx reverse proxy. You create backup jobs, schedule them, set retention, and browse and restore individual files or whole directories from the web UI.

What you get:

The Duplicati web UI and REST API on the loopback interface at 127.0.0.1:8200, never exposed directly to the network
nginx as a reverse proxy that terminates TLS on port 443 with a per-instance self-signed certificate and redirects plain HTTP on port 80
WebSocket proxying for live task and progress updates, already configured in nginx
The server configuration database and the default local backup destination under /var/lib/duplicati on a dedicated EBS data volume, independently resizable and separate from the operating system disk
A one-shot first-boot service that generates a web password, a TLS certificate and a database encryption key unique to your instance, and starts Duplicati with authentication required
First-boot checks that confirm an unauthenticated API request is refused, a wrong password is refused, the generated password is accepted, and a real backup and restore round trip matches byte for byte
The password written to /root/duplicati-credentials.txt with mode 0600, and no shared or default credentials in the image
A health endpoint for load balancers that stays open while the UI and API require the generated password

Connecting to your instance

Connect over SSH as the default login user for your operating system variant. This listing ships the following variant:

OS variant SSH login user

Ubuntu 24.04 LTS ubuntu

Prerequisites

Before you deploy, make sure you have:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound port 443 from the networks your operators will reach the Duplicati UI on (port 80 is only used to redirect to HTTPS and to answer load-balancer health checks)
The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Duplicati. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Choose an instance type (the listing recommends m5.large), select your key pair, and configure a security group as described in the prerequisites. Leave the storage at the defaults. The AMI carries a dedicated data volume for the configuration database and local backup destination, in addition to the operating system disk.

Choose Launch instance.

Launch the Instance from the AWS CLI

Find the AMI ID for the listing in your Region, then launch it. Replace the example values in the command with your own.

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key-pair \
  --security-group-ids sg-xxxxxxxxxxxxxxxxx \
  --subnet-id subnet-xxxxxxxxxxxxxxxxx \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=duplicati}]' \
  --region us-east-1

The instance metadata options require IMDSv2 (HttpTokens=required). The first-boot service uses IMDSv2 to discover the instance's public IP address for the TLS certificate and the credentials file.

Connect and Retrieve the Web Password

After the instance finishes its first boot, connect over SSH as the login user for your variant. For the Ubuntu 24.04 variant this is ubuntu. Then read the generated credentials file:

ssh -i your-key.pem ubuntu@<public-ip>
sudo cat /root/duplicati-credentials.txt

The file contains the web URL and the per-instance password:

DUPLICATI_URL=https://<public-ip>/ DUPLICATI_PASSWORD=<generated-password>

Confirm the stack is healthy from the shell. The service and reverse proxy should both be active, the health endpoint should answer without authentication, and the REST API should return 401 until you present the password:

systemctl is-active duplicati nginx curl -sk https://127.0.0.1/healthz curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/api/v1/backups

The output shows active twice, then ok, then 401. Next, confirm the listeners. Duplicati serves the web UI on loopback 127.0.0.1:8200, and nginx listens on ports 80 and 443:

sudo ss -tlnp | grep -E ':443|:80|:8200'

First Sign-in

Open the web URL from the credentials file in your browser (https://<public-ip>/). The certificate is a per-instance self-signed certificate, so your browser warns on the first visit. Accept it to continue. Step 8 covers installing a CA-signed certificate for production.

Sign in with the generated password. Duplicati then offers to connect to its optional hosted console. You can skip it and use the fully self-hosted server. The home screen shows your backup jobs, with quick actions to create a backup or start a restore.

Create an Encrypted Backup Job

Choose Add backup in the sidebar, then Add a new backup, to open the backup wizard. Give the job a name and a strong encryption passphrase. Choose the source files and folders to protect, pick a destination, and set a schedule and retention policy.

The destination can be a local folder on the dedicated data volume, a network share, or a cloud provider such as S3-compatible object storage or Backblaze B2. A local destination is ready to use at /var/lib/duplicati/backups on the data disk. Duplicati encrypts and deduplicates the data before writing it, so the destination only ever sees encrypted blocks.

Keep your passphrase safe. You need the backup passphrase to restore your data, and it cannot be recovered if lost. Store it somewhere secure and separate from the instance.

Restore Files

Choose Restore in the sidebar to recover files. You can restore from an existing job, from backup files at a destination, or from an exported job configuration. Browse any previous version to restore individual files or a whole set.

Duplicati asks for the job's passphrase before it decrypts and restores.

Verify a Backup and Restore Round-trip

The image includes a self-test that you can run at any time. It confirms that the web API requires the per-instance password: an unauthenticated request and a wrong password are both refused, and the correct password is accepted.

It then performs a real backup and restore round trip through the Duplicati engine. It encrypts a canary file to a destination on the dedicated data volume, restores it to a fresh directory, and confirms by SHA-256 that the restored contents match byte for byte. A restore with the wrong passphrase is refused.

sudo /opt/duplicati-sac/duplicati-selftest.sh

A successful run prints a line beginning OK: and exits zero. The configuration database and backup data live on the dedicated data volume. Confirm that it is a separate disk mounted at /var/lib/duplicati:

findmnt /var/lib/duplicati

Review the Server Settings

Choose Settings in the sidebar to review the server configuration. Here you can change the server passphrase, set the interface theme and language, and manage the optional console connection.

The Duplicati server in this image is fully self-hosted and requires the per-instance password generated on first boot.

Add a CA-signed Certificate

The image serves the UI over HTTPS with a per-instance self-signed certificate from the first boot. For production, point a DNS name at the instance and open port 443 in the security group to your operators' networks. Then replace the certificate with a CA-signed one, for example with certbot. On the Ubuntu variant, run:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-duplicati-host.example.com

certbot obtains a certificate, edits the nginx site to serve TLS on port 443, and sets up automatic renewal. The reverse-proxy configuration for Duplicati, including the WebSocket upgrade, is preserved.

Change the Web Password

The per-instance web password is stored in the Duplicati service configuration on the instance. To change it, edit the --webservice-password value in /etc/default/duplicati and restart the service:

sudo sed -i 's/--webservice-password=[^ "]*/--webservice-password=<new-password>/' /etc/default/duplicati
sudo systemctl restart duplicati

You can also change the server passphrase from the Settings screen described in Step 8. Either way, the new password takes effect immediately and the old one stops working.

Support

SecureAnyCloud provides 24/7 technical support by email and chat for this image. Support covers deployment, HTTPS and reverse-proxy configuration, backup destination and retention planning, and storage sizing and upgrades. Contact details are on the AWS Marketplace listing and at secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Duplicati Encrypted Backup on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS