Kopia - Backblaze B2 Kopia - Backblaze B2

[SSO] Backups Using the Cloud Storage You Pick

Encrypted, Compressed, and Deduplicated Backups Using the Cloud Storage You Pick Cross-platform backup tool for Windows, macOS & Linux with fast, incremental backups, client-side end-to-end encryption, compression and data deduplication. CLI and GUI included.

This instance’s repository uses Backblaze B2 through Kopia’s deprecated native b2 provider. The migration plan describes moving the repository to the S3-compatible provider and the rollback procedure. See docs/plans/kopia-b2-s3-provider.md for migration details.

References

Authentik

Authentik ForwardAuth is Kopia B2’s browser access gate for the admins group. Kopia’s repository password remains separate from browser authentication. The service depends on the isolated backup-kopia network and Traefik as its sole UI path.

Setup

scripts/authentik-apps.py --application kopia-b2 --apply
scripts/labctl.py service recreate backup/kopia-b2

Keep the router middleware as localaccess-authentik@file, Traefik connected to backup-kopia, and no Kopia UI host port published. The current Kopia server flags deliberately disable its own browser login because the network boundary and ForwardAuth are required; do not reuse this configuration where direct network access is possible.

Verify

Confirm an admins member can use the UI, a non-member is denied, group removal applies after session refresh, recovery works, and no direct container or host path reaches the UI.

name: kopia-b2
services:
  kopia-b2:
    image: kopia/kopia:0.23.1@sha256:89fd95ee2942880ca00eae964266958a394421ddbdf69bca62e38afc55f5900e
    container_name: kopia-b2
    restart: "unless-stopped"
    user: "0:0"
    # kics-scan ignore-line
    privileged: true
    cap_add:
      - SYS_ADMIN
    # kics-scan ignore-line
    security_opt:
      - apparmor:unconfined
    devices:
      - /dev/fuse:/dev/fuse:rwm
    command:
      - server
      - start
      # The UI is reachable only through Traefik and Authentik ForwardAuth.
      - --disable-csrf-token-checks
      - --insecure
      - --without-password
      - --address=0.0.0.0:80
      - --allow-extremely-dangerous-unauthenticated-server-on-the-network
    environment:
      USER: ${ADMIN_USER}
      KOPIA_PASSWORD: ${KOPIA_B2_REPOSITORY_PASSWORD}
      TZ: ${TIMEZONE}

    # kics-scan ignore-block
    volumes:
      - ${DOCKER_VOLUMES}/kopia-b2/config:/app/config
      - ${DOCKER_VOLUMES}/kopia-b2/cache:/app/cache
      - ${DOCKER_VOLUMES}/kopia-b2/logs:/app/logs

      # Local (source)
      - /etc:/sources/local/etc:ro
      - ${ADMIN_HOME}/repos:/sources/local/repos:ro
      # Snapshot policy is managed by scripts/backup
      - ${DOCKER_VOLUMES}:/sources/local/docker-volumes:ro
      # Snapshot policy is managed by scripts/backup
      - ${DB_BACKUP_ROOT}/latest:/sources/local/db-backups:ro

      # NAS (source)
      - ${STORAGE_FAMILYMEDIA}:/sources/nas/family-media:ro
      - ${STORAGE_MEDIA}:/sources/nas/media:ro

    networks:
      - backup-kopia

    labels:
      traefik.enable: true
      traefik.docker.network: backup-kopia
      traefik.http.routers.kopia-b2.middlewares: localaccess-authentik@file
      traefik.http.services.kopia-b2.loadbalancer.server.port: 80
      homepage.group: Storage
      homepage.name: Kopia - Backblaze B2
      homepage.icon: kopia.png
      homepage.href: https://kopia-b2.${MYDOMAIN}/
      homepage.description: "[SSO] Backups Using the Cloud Storage You Pick"

networks:
  backup-kopia:
    external: true