Deployment guide

Kopia

Overview

Kopia is a fast, secure, open-source backup tool. It creates encrypted, compressed, deduplicated snapshots of your files and stores them in a repository that you control. The repository can be a local disk, a network share or any major cloud object store.

The SecureAnyCloud image installs Kopia 0.23.1 and runs its HTML web UI and REST API as a systemd service. The service is bound to loopback behind an nginx reverse proxy on port 80. The repository sits on a dedicated Azure data disk, and every VM generates its own unique repository and server passwords on first boot.

What you get:

Kopia 0.23.1 (binary /usr/bin/kopia) installed from the official Debian package
A filesystem repository at /var/lib/kopia/repo on a dedicated Azure data disk
The Kopia HTML web UI and REST API served on loopback 127.0.0.1:51515 with HTTP Basic auth
nginx on :80 as a reverse proxy to the loopback Kopia backend, plus an unauthenticated static /health endpoint
Per-VM repository, server and server-control passwords generated on first boot and recorded in a root-only file
kopia.service and nginx.service as systemd units, enabled and active
24/7 SecureAnyCloud support

Prerequisites

An active Azure subscription
An SSH key pair
A VNet and subnet in the target region

Standard_B2s (2 vCPU, 4 GiB RAM) is a good starting point. Allow 22/tcp from your management network and 80/tcp in the NSG inbound rules. Kopia serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Kopia by SecureAnyCloud and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:kopia-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name kopia \
  --image sac1647283583153:kopia-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name kopia --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active kopia.service nginx.service

Both report active. On first boot, Kopia generates per-VM passwords and creates the filesystem repository.

Step 5 - Retrieve your server password

Your VM generates a unique Kopia server (web UI) password on first boot and writes it to a root-only file:

sudo cat /root/kopia-credentials.txt

The file contains KOPIA_SERVER_USERNAME (admin), kopia.server.pass (the web UI password) and kopia.repository.pass. You need the repository password only to open the repository directly with the CLI. Store these somewhere safe.

Step 6 - Confirm the health endpoint

nginx serves an unauthenticated health endpoint for load balancers and probes:

curl -s http://localhost/health

It returns ok. The Kopia API itself requires authentication (see Step 8).

Step 7 - Open the Kopia web UI

Browse to http://<vm-public-ip>/ and sign in as admin with the password from Step 5. Use the web UI to browse snapshots, manage repository policies, define snapshot sources and watch running tasks.

The Repository tab shows the connected filesystem repository, its status, capacity and storage configuration.
The Policies tab is where you set retention, compression, scheduling and file-ignore rules, globally or per source.
The Tasks tab lists running and recent operations (snapshots, maintenance and restores) with live progress.

Step 8 - Verify the server from the command line

The Kopia server exposes a control API that uses HTTP Basic auth with the dedicated server-control account. An unauthenticated request is rejected with 401. The per-VM server-control password authenticates. Read the password into a variable, then call the status endpoint:

KOPIA_CTRL_PASS=$(sudo grep '^kopia.server.control.pass=' /root/kopia-credentials.txt | cut -d= -f2-)
curl -s -u "server-control:$KOPIA_CTRL_PASS" http://localhost/api/v1/control/status | head -c 200; echo

The response is a JSON object with "connected": true and the repository configuration. This proves the server is connected to the filesystem repository and your credentials work. The browser web UI on port 80 signs in with the admin account and kopia.server.pass from Step 5.

Step 9 - Confirm the repository lives on the dedicated disk

The Kopia filesystem repository and config live on a dedicated Azure data disk. They survive OS changes, and you can resize the disk independently:

findmnt /var/lib/kopia

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM. The repository is at /var/lib/kopia/repo.

Building your backup workflow

Use the web UI to add snapshot sources (directories to back up) and set policies for retention, compression and scheduling. Run snapshots on demand or on a schedule.

You can also drive everything with the kopia CLI on the VM. The server already holds the repository connection, so commands like kopia snapshot list and kopia policy set work once you connect the CLI to the same repository. See the Kopia documentation for repository back-ends (S3, Azure Blob, B2, GCS), encryption and the command reference.

Maintenance

Snapshots: create and browse snapshots from the web UI, or with kopia snapshot on the VM.
Repository back-ends: this image ships a filesystem repository. Kopia also supports S3, Azure Blob, Google Cloud Storage, Backblaze B2 and more.
Repository location: the repository and config live under /var/lib/kopia on the dedicated data disk.
TLS: Kopia serves plain HTTP on port 80. Front it with TLS (for example, certbot) and your own domain before running it in production.
Upgrades: install a newer Kopia .deb (or replace /usr/bin/kopia) and run sudo systemctl restart kopia.
Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. Contact sales@secureanycloud.com.

Deploy on Azure

Launch Kopia on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This image runs Kopia, the fast and secure open-source backup and restore tool. Kopia creates encrypted, compressed and globally deduplicated snapshots of your files and directories. It stores them in a repository on a filesystem, on cloud object storage such as Amazon S3, or on a Kopia repository server.

The image delivers Kopia in server mode with its browser-based web UI, so a production-grade backup server is running within minutes of launch.

What you get:

The Kopia binary under /opt/kopia, running as a dedicated unprivileged kopia system account under a systemd service that starts on boot and restarts on failure.
The Kopia config, the content cache and a demo filesystem repository under /var/lib/kopia, on a dedicated, independently resizable EBS data volume.
A Kopia server bound to the loopback interface only, never exposed directly, with an nginx reverse proxy that publishes the web UI on port 80.
Kopia's own HTTP Basic authentication, with a web UI password, a server control password and a repository password generated on the first boot of every instance. Two instances launched from the same Amazon Machine Image never share a password.
Credentials written to /root/kopia-credentials.txt with mode 0600, so only the root user can read them.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the web UI
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Kopia. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of t3.small or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet. Create or select a security group that opens port 22 from your management network and port 80 for the web UI. Leave the root volume at the default size or larger.

Select Launch instance. First-boot initialisation takes a few seconds after the instance state becomes Running and the status checks pass.

Launch the Instance from the AWS CLI

This command launches an instance from the SecureAnyCloud Kopia Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing and <key-name> with your EC2 key pair name. Replace <subnet-id> with your subnet ID and <security-group-id> with a security group that opens ports 22 and 80.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type t3.small \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=kopia}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect to Your Instance

Connect over SSH with your key pair and the login user for your operating system variant.

OS variant SSH login user

Ubuntu 24.04 ubuntu

ssh -i <key-name>.pem ubuntu@<public-ip>

Retrieve the Credentials

Your instance generated a unique web UI password on first boot. Read the credentials file as root:

sudo cat /root/kopia-credentials.txt

The file lists the web UI URL, the web UI user (admin) and generated password, the server control credentials, and the password of the demo filesystem repository. Keep these somewhere safe.

Sign In to the Kopia Web UI

nginx serves the Kopia web UI on port 80 in front of the Kopia server, which provides its own HTTP Basic authentication. In a browser, go to:

http://<instance-public-ip>/

Sign in as admin with the password from the credentials file. The UI opens onto the connected demo filesystem repository, where you can browse snapshots, define sources and policies, and restore data.

The Policies view sets snapshot retention, compression, scheduling and the files to ignore, globally and per source.
The Repository view shows the status of the connected repository, its encryption and splitter configuration, and the running tasks.

Confirm Kopia Is Running

Over SSH, confirm that the Kopia server and the nginx proxy are active and that the ports are listening:

sudo systemctl is-active kopia-server nginx
sudo ss -tlnp | grep -E ':(80|51515) '

You should see both services reported as active, the Kopia server listening on 127.0.0.1:51515 (loopback only), and nginx listening on port 80.

The Demo Filesystem Repository

The image ships connected to a demo filesystem repository at /var/lib/kopia/repo, so the server has a repository to show the moment you sign in. Its password is the kopia.repo.password value in the credentials file. Filesystem repositories suit backups to an attached EBS volume or an NFS mount.

To inspect the connected repository from the command line, run the CLI as the kopia service account and point it at the same config and cache the server uses:

sudo -u kopia env KOPIA_CONFIG_PATH=/var/lib/kopia/config/repository.config KOPIA_CACHE_DIRECTORY=/var/lib/kopia/cache /opt/kopia/kopia repository status

Create Your First Snapshot

In the web UI, open the Snapshots view and choose New Snapshot. Enter a path on the instance to back up, for example a documents directory. Kopia takes an encrypted, compressed and deduplicated snapshot and lists it under the source. Later snapshots of the same source are incremental and fast, because unchanged content is deduplicated.

You can also snapshot from the command line:

sudo -u kopia env KOPIA_CONFIG_PATH=/var/lib/kopia/config/repository.config KOPIA_CACHE_DIRECTORY=/var/lib/kopia/cache /opt/kopia/kopia snapshot create /usr/share/doc

Define Snapshot Policies

Policies control retention, compression, scheduling and which files to ignore. In the Policies view, edit the global policy or a per-source policy. You can keep a number of hourly, daily, weekly, monthly and annual snapshots, enable compression and set an automatic snapshot interval. Policies are stored in the repository and apply to every snapshot.

Connect an Object Storage Repository

For production backups, connect a repository on Amazon S3 or another object store. From the command line, create an S3 repository and replace the placeholders with your bucket and credentials:

sudo -u kopia env KOPIA_CONFIG_PATH=/var/lib/kopia/config/repository.config KOPIA_CACHE_DIRECTORY=/var/lib/kopia/cache KOPIA_PASSWORD='<your-repository-password>' /opt/kopia/kopia repository create s3 --bucket <your-bucket> --access-key <your-access-key> --secret-access-key <your-secret-key>

After connecting a new repository, restart the server with sudo systemctl restart kopia-server so the UI reflects it. Prefer an EC2 instance role over static keys: grant the instance an IAM role with access to the backup bucket.

Restore Data

To restore, open a snapshot in the web UI, browse its directory tree, and download a file or restore a directory to a path you choose. From the command line, you can mount a snapshot or restore it directly:

sudo -u kopia env KOPIA_CONFIG_PATH=/var/lib/kopia/config/repository.config KOPIA_CACHE_DIRECTORY=/var/lib/kopia/cache /opt/kopia/kopia snapshot list

Pick a snapshot ID from the list and restore it to a target directory with kopia restore <snapshot-id> <target-path>.

The Data Volume

The Kopia config, the content cache and the demo repository live on a dedicated EBS volume mounted at /var/lib/kopia. This keeps backup state off the operating system disk and lets you resize or snapshot it independently. Confirm the mount with:

df -h /var/lib/kopia

To grow the volume, expand the EBS volume in the AWS console. Then grow the filesystem on the instance with sudo resize2fs on the underlying device.

Enable HTTPS

nginx serves the web UI over plain HTTP on port 80. For production use, place it behind TLS.

Obtain a certificate for your domain, for example a managed certificate on an Application Load Balancer in front of the instance, or Certbot installed on the instance. Then configure nginx to listen on 443 with your certificate and proxy to 127.0.0.1:51515, exactly as the bundled site does for port 80. Restrict the security group so ports 80 and 443 are reachable only from the networks that operate the backup server.

The Server Control API

The Kopia server exposes a control API on the same port behind the server control credentials. It is useful for monitoring and automation, and it does not require a browser CSRF token. Query the connected repository status with the control user:

CTRL=$(sudo grep '^kopia.control.pass=' /root/kopia-credentials.txt | cut -d= -f2-); curl -s -u "server-control:${CTRL}" http://127.0.0.1/api/v1/control/status

Backup and Maintenance

Kopia performs its own repository maintenance automatically. Back up a filesystem repository by snapshotting the /var/lib/kopia EBS volume. An object storage repository relies on the durability of the object store.

Apply operating system security updates with sudo apt-get update && sudo apt-get upgrade, and reboot when a new kernel is installed. Kopia and nginx start automatically on boot.

Support

SecureAnyCloud publishes and supports this image. Support covers deployment, repository configuration on filesystem and object storage, snapshot policies and scheduling, retention and compression tuning, the repository server mode, TLS and restore workflows. Contact SecureAnyCloud through the support channel on the AWS Marketplace listing.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Kopia on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS